# cnxvinyl.lol: internal test site on the buildfor.life web server (s1).
# Static web root /var/www/cnxvinyl.lol, filled by
# .gitea/workflows/deploy-site.yml in the cnx_vinyl repo.
#
# Append these blocks to /etc/caddy/Caddyfile on s1. They reuse the
# cloudflare_only and security_headers snippets defined there for
# buildfor.life (buildfor_life_web: infra/caddy/Caddyfile.example); if
# they are missing, validate fails with "File to import not found:
# cloudflare_only" and they have to be copied in from the example first.
#   caddy validate --config /etc/caddy/Caddyfile
#   systemctl reload caddy
#
# Cloudflare: both names proxied (orange cloud), SSL/TLS mode "Full (strict)".
# "Flexible" sends plain HTTP to Caddy, which redirects to HTTPS: a loop.
# Same rule as the buildfor.life apex: if a record is ever switched to DNS
# only, remove "import cloudflare_only" first or that name goes dark.

cnxvinyl.lol {
	import cloudflare_only
	import security_headers
	header X-Frame-Options "SAMEORIGIN"
	# Internal testing: keep every page and file out of search engines.
	header X-Robots-Tag "noindex, nofollow"

	# Optional login for the whole site. Make the hash on s1 with
	#   caddy hash-password
	# then uncomment and fill in:
	# basic_auth {
	# 	<user> <hash>
	# }

	root * /var/www/cnxvinyl.lol
	encode zstd gzip
	file_server
}

www.cnxvinyl.lol {
	import cloudflare_only
	redir https://cnxvinyl.lol{uri} permanent
}