Caddyfile

{
    # Uncomment for production with a real domain
    # email admin@example.com
}

:80, :443 {
    # caddy:2 ships zstd + gzip but NOT brotli — listing `br` makes Caddy fail
    # to start ("encoder module br not registered").
    encode zstd gzip

    # The API namespaces every route under /api itself (e.g. /api/auth/login).
    # Do NOT strip the prefix here, or requests reach the API as /auth/login
    # and 404.
    handle /api/* {
        reverse_proxy api:3000
    }

    handle /events {
        reverse_proxy api:3000
    }

    handle /agent-socket {
        reverse_proxy api:3000
    }

    # Auth-checked file serving lives at /files/<key> on the API.
    handle /files/* {
        reverse_proxy api:3000
    }

    handle {
        reverse_proxy web:80
    }
}