# SITE_ADDRESS is the domain to serve (e.g. lottery.example.com) — Caddy
# automatically requests a Let's Encrypt certificate for it.
#
# Left at the default "localhost" (dev mode, no domain), Caddy detects it's
# not a public hostname and issues a locally-trusted self-signed certificate
# instead, via its internal CA. Browsers will still warn on first visit
# unless that CA is explicitly trusted — expected for local/dev use.
{$SITE_ADDRESS:localhost} {
	# gzip buffers output, which would delay delivery on the SSE stream
	# (/rounds/stream, app/api/routes/rounds.py) — it needs each event flushed
	# to the client immediately, not batched. Everything else still compresses.
	@not_sse {
		not path /rounds/stream
	}
	encode @not_sse gzip
	reverse_proxy app:8123
}