# Containerized variant of ../Caddyfile — same design (single origin, /api/* proxied
# to the backend, static frontend otherwise, security headers), adapted for Docker
# Compose networking: the backend is reached by its service name, and the static
# files are the ones baked into this image's build stage (see frontend/Dockerfile)
# rather than an absolute host path.
#
# WebSocket job-progress updates live under /api/v1/ws/... , so the /api/* proxy below
# already covers them — no separate handling needed (Caddy's reverse_proxy transparently
# handles the WebSocket upgrade).

:80 {
	handle /api/* {
		reverse_proxy backend:8000
	}

	handle {
		root * /srv
		try_files {path} /index.html
		file_server
		encode gzip
	}

	header {
		X-Content-Type-Options nosniff
		X-Frame-Options DENY
		Referrer-Policy strict-origin-when-cross-origin
	}
}
