# Sibyl reverse proxy. TLS via Let's Encrypt over the Cloudflare
# DNS-01 challenge, so the host needs no public inbound 80/443.

{
	acme_dns cloudflare {env.CF_API_TOKEN}
}

{$SIBYL_DOMAIN} {
	# reverse_proxy discards any X-Forwarded-For an untrusted client sends and
	# sets it to the address Caddy saw, which the backend trusts through
	# SIBYL_FORWARDED_ALLOW_IPS. Adding trusted_proxies here makes Caddy
	# append instead; list those upstream proxies on the backend too.
	@backend path /api/* /mcp /mcp/* /_oauth/*
	handle @backend {
		reverse_proxy backend:3334
	}

	handle {
		reverse_proxy frontend:3337
	}
}
