# /etc/caddy/Caddyfile on the VPS.
# Each domain's A/AAAA record must already point at this VPS — Caddy provisions a
# Let's Encrypt cert on first request and auto-renews. Nothing else to do for TLS
# (just make sure ports 80 and 443 are open).
#
# Layout:
#   thermograph.org/*              -> the Thermograph app (reverse-proxied to uvicorn)
#   emigriffith.dev/               -> static portfolio site (served straight from disk)
#   emigriffith.dev/thermograph*   -> permanent redirect to thermograph.org (the app moved)
#
# Thermograph now owns thermograph.org's root, so it must run with
# THERMOGRAPH_BASE=/ (see /etc/thermograph.env) — the app serves its pages, assets
# and API at "/" with no sub-path prefix. One uvicorn on 127.0.0.1:8137 backs both
# thermograph.org (proxied) and the emigriffith.dev redirect.

thermograph.org {
	encode zstd gzip

	# The app serves everything at the root now (THERMOGRAPH_BASE=/).
	# Active health check on the same cheap /healthz route the container's own
	# HEALTHCHECK uses (Dockerfile) — so a deploy that's still restarting/booting
	# never gets proxied into (a reload alone has no gate, hop-1 runbook hazard #10).
	reverse_proxy 127.0.0.1:8137 {
		health_uri /healthz
		health_interval 5s
		health_timeout 3s
		health_status 2xx
	}

	log {
		output file /var/log/caddy/thermograph.log
	}
}

emigriffith.dev {
	encode zstd gzip

	# Thermograph moved to its own domain. Send the old sub-path there with a
	# permanent redirect, stripping the /thermograph prefix so deep links map
	# straight across (…/thermograph/calendar -> thermograph.org/calendar). The
	# bare /thermograph (no trailing slash) goes to the new root.
	handle_path /thermograph/* {
		redir https://thermograph.org{uri} permanent
	}
	handle /thermograph {
		redir https://thermograph.org/ permanent
	}

	# Portfolio at the root. Point `root` at the built static site (for the Astro
	# portfolio that's its `dist/` output). file_server serves index.html for
	# directories and returns a real 404 for missing paths.
	handle {
		root * /var/www/emigriffith
		file_server
	}

	log {
		output file /var/log/caddy/emigriffith.log
	}
}

# Old bookmarks to the raw IP (the pre-domain URL) would otherwise get bounced to
# HTTPS-on-the-IP, which has no cert and fails. Redirect them to the portfolio domain.
http://75.119.132.91 {
	redir https://emigriffith.dev{uri} permanent
}

# Optional: redirect www -> apex for either domain. Add the www CNAME/A record
# first, then uncomment the matching block.
# www.emigriffith.dev {
# 	redir https://emigriffith.dev{uri} permanent
# }
# www.thermograph.org {
# 	redir https://thermograph.org{uri} permanent
# }