# Caddy config for slab.local with file-based TLS.
# Uses pre-generated self-signed certs from certs/ directory.
# Caddy's internal CA is NOT used; file-based certs avoid CA trust setup.
# :443 catch-all ensures IP-based SNI does not fail; slab.local is the primary name.

:443 {
	tls /etc/caddy/certs/slab.crt /etc/caddy/certs/slab.key
	handle /api/* {
		reverse_proxy fastapi:8000
	}
	handle {
		reverse_proxy frontend:80 {
			header_up X-Real-IP {remote_host}
		}
	}
}