# /etc/caddy/Caddyfile on **vps1** (75.119.132.91) — the operational-programs box.
#
# vps1 serves:
#   emigriffith.dev            -> static portfolio site (from disk)
#   git.thermograph.org        -> Forgejo         (see deploy/forgejo/caddy-git.conf)
#   dashboard.thermograph.org  -> Grafana         (see observability/caddy-grafana.conf)
#
# and hosts the **dev** environment, which is deliberately ABSENT from this
# file. Dev has no site block, no DNS record and no certificate: it publishes on
# the WireGuard address only (http://10.10.0.2:8137) and is reachable from the
# mesh and nowhere else. Dev runs whatever branch is in flight, on the same box
# as Forgejo and its CI — putting it behind a public hostname would be handing
# the internet an unreviewed build. If you ever need it reachable from a phone,
# join the phone to the mesh; do not add a site block here.
#
# beta.thermograph.org is NOT here either — beta moved to vps2, next to prod.
# That is the one edit in this file most likely to be made by mistake: a "beta"
# reference elsewhere in the repo that still points at 75.119.132.91 means this
# box, which no longer runs beta at all.
#
# Each domain's A/AAAA record must already point here — Caddy provisions a
# Let's Encrypt cert on first request and auto-renews.

emigriffith.dev {
	encode zstd gzip

	# Thermograph moved to its own domain. Send the old sub-path there with a
	# permanent redirect, stripping the /thermograph prefix so deep links map
	# straight across (…/thermograph/calendar -> thermograph.org/calendar). The
	# bare /thermograph (no trailing slash) goes to the new root.
	handle_path /thermograph/* {
		redir https://thermograph.org{uri} permanent
	}
	handle /thermograph {
		redir https://thermograph.org/ permanent
	}

	# Portfolio at the root. Point `root` at the built static site (for the Astro
	# portfolio that's its `dist/` output). file_server serves index.html for
	# directories and returns a real 404 for missing paths.
	handle {
		root * /var/www/emigriffith
		file_server
	}

	log {
		output file /var/log/caddy/emigriffith.log
	}
}

# Old bookmarks to the raw IP (the pre-domain URL) would otherwise get bounced to
# HTTPS-on-the-IP, which has no cert and fails. Redirect them to the portfolio domain.
http://75.119.132.91 {
	redir https://emigriffith.dev{uri} permanent
}

# Optional: redirect www -> apex. Add the www CNAME/A record first, then
# uncomment.
# www.emigriffith.dev {
# 	redir https://emigriffith.dev{uri} permanent
# }