Caddyfile

# Production Caddyfile
# Set DOMAIN env var for HTTPS, otherwise serves HTTP on port 80

{$DOMAIN::80} {
    # Automatic HTTPS with Let's Encrypt
    # (only works with real domain, not localhost)

    # Reverse proxy to Nuxt app
    reverse_proxy app:3000 {
        # Health check
        health_uri /api/health
        health_interval 30s

        # Headers
        header_up X-Real-IP {remote_host}
        header_up X-Forwarded-For {remote_host}
        header_up X-Forwarded-Proto {scheme}
    }

    # Compression
    encode gzip zstd

    # Security headers
    header {
        X-Content-Type-Options nosniff
        X-Frame-Options DENY
        Referrer-Policy strict-origin-when-cross-origin
        -Server
    }

    # Logging
    log {
        output file /data/access.log {
            roll_size 10mb
            roll_keep 5
        }
    }
}