# isokit.buildfor.life: the web Studio on the buildfor.life web server (s1).
# Static web root /var/www/isokit.buildfor.life, filled by
# .gitea/workflows/deploy-web.yml (tools/build_web.py -> dist/web).
#
# Append this block to /etc/caddy/Caddyfile on s1, then
#   runuser -u caddy -- caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile
#   systemctl reload caddy
# This file mirrors what s1 runs; keep the two in step.
#
# DNS: *.buildfor.life is a proxied wildcard at Cloudflare that reaches s1,
# so the name needs no record of its own. Caddy gets its certificate itself.

isokit.buildfor.life {
	header X-Frame-Options "SAMEORIGIN"
	# Testing deployment: keep it out of search engines.
	header X-Robots-Tag "noindex, nofollow"

	# The agent window's relay to B4L's inference server (the build's
	# default endpoint, build_web.py --agent-url /llm/v1). Same site, so the
	# page needs no CORS from the endpoint, whose nginx answers the CORS
	# preflight with 401. The relay adds no key: the page sends the one its
	# user entered, so only key holders get answers. flush_interval -1 passes
	# the streamed tokens on as they come.
	handle_path /llm/* {
		reverse_proxy https://inference.p0.contact {
			header_up Host {upstream_hostport}
			header_up -Cookie
			header_up -Origin
			header_up -Referer
			flush_interval -1
		}
	}

	handle {
		# Revalidate everything: isokit_wasm.js and its .wasm load without a
		# version query, and a stale copy at Cloudflare would not match the
		# new glue code after a deploy. Unchanged files still come back as 304.
		header Cache-Control "no-cache"
		root * /var/www/isokit.buildfor.life
		encode zstd gzip
		file_server
	}
}