{
	email {$ACME_EMAIL}
}

(security_headers) {
	header {
		Strict-Transport-Security "max-age=31536000; includeSubDomains"
		X-Content-Type-Options "nosniff"
		X-Frame-Options "SAMEORIGIN"
		Referrer-Policy "strict-origin-when-cross-origin"
		-Server
	}
}

{$PUBLIC_DOMAIN} {
	import security_headers
	encode zstd gzip

	# /admin is a vanity redirect to /_/, PocketBase's own fixed dashboard
	# route — handled by Nitro (frontend/server/routes/admin.get.ts), not
	# here, so it also works in dev where Caddy isn't in the stack.

	# PocketBase's admin UI (/_/) and its own REST/file API (/api/*) both
	# reference themselves with root-absolute paths, so they must be
	# reachable unprefixed at the domain root — a path like /admin/api/...
	# with a stripped prefix would break the dashboard's own asset and API
	# calls. This is why the frontend's Nitro endpoints live under
	# /content/*, not /api/*: /api is reserved for PocketBase here.
	@pocketbase path /_/* /api/*
	handle @pocketbase {
		# Cover images and admin uploads pass through here too.
		request_body {
			max_size 100MB
		}
		reverse_proxy pocketbase:8090
	}

	handle {
		reverse_proxy frontend:3000
	}
}