# Internal Caddy used by the prod container to serve the static site.
# caddy-docker-proxy terminates TLS at the edge, forwards to :80 here.

:80 {
	root * /srv
	file_server
	encode gzip zstd

	# Long-cache everything Astro puts under /_astro/ (hashed filenames)
	@immutable path /_astro/*
	header @immutable Cache-Control "public, max-age=31536000, immutable"

	# Short-cache HTML so content updates appear quickly after redeploy.
	@html path_regexp htmlrx \.(html)?$
	header @html Cache-Control "public, max-age=60, must-revalidate"

	# Basic security headers
	header {
		X-Content-Type-Options nosniff
		Referrer-Policy strict-origin-when-cross-origin
		X-Frame-Options SAMEORIGIN
		-Server
	}

	# Render 404 for missing pages
	handle_errors {
		@404 expression {http.error.status_code} == 404
		rewrite @404 /404.html
		file_server
	}
}