thermograph/infra/terraform/modules/thermograph-host/templates/Caddyfile.tftpl

# /etc/caddy/Caddyfile — RENDERED BY TERRAFORM for ${domain}.
# Caddy provisions a Let's Encrypt cert on first request and auto-renews; the domain's
# A/AAAA record must already point at this host and ports 80/443 must be open.
#
# The app owns the domain root and runs with THERMOGRAPH_BASE=/. Repo-split
# Stage 4: backend (127.0.0.1:${port}) and frontend (127.0.0.1:${frontend_port})
# are two containers now -- path-split directly to whichever owns a given
# path. Repo-split Stage 7a flipped which side owns the enumerated list:
# backend owns the short, stable set below (mirrors backend/web/app.py's own
# routing exactly -- a single catch-all proxy to frontend for everything
# else), so the two never disagree about who owns what.
#
# NOTE: the repo's deploy/Caddyfile additionally serves the emigriffith.dev portfolio
# and legacy redirects; those are host-specific and intentionally not templated here.
${domain} {
	encode zstd gzip

	@backend_paths path /api/* /digest /discord/interactions

	# Active health check on the same cheap /healthz route each container's own
	# HEALTHCHECK uses (Dockerfile) — so a `docker compose up -d --build` deploy
	# that's still restarting/booting never gets proxied into (a reload alone has
	# no gate, hop-1 runbook hazard #10). health_uri is relative to the upstream.
	handle @backend_paths {
		reverse_proxy 127.0.0.1:${port} {
			health_uri /healthz
			health_interval 5s
			health_timeout 3s
			health_status 2xx
		}
	}

	handle {
		reverse_proxy 127.0.0.1:${frontend_port} {
			health_uri /healthz
			health_interval 5s
			health_timeout 3s
			health_status 2xx
		}
	}

	log {
		output file /var/log/caddy/thermograph.log
	}
}