Caddyfile

# Caddyfile for TLS termination
# Environment variables: PUBLIC_DOMAIN, PROXY_HOST

{$PUBLIC_DOMAIN:localhost} {
    # Automatic HTTPS with Let's Encrypt (production)
    # For local development with self-signed cert, Caddy will auto-generate
    
    # Reverse proxy to the authsec-openclaw-proxy
    reverse_proxy {$PROXY_HOST:proxy:8080} {
        # Preserve original request information
        header_up Host {host}
        header_up X-Real-IP {remote_host}
        header_up X-Forwarded-For {remote_host}
        header_up X-Forwarded-Proto {scheme}
        header_up X-Forwarded-Host {host}
        
        # WebSocket support
        header_up Connection {>Connection}
        header_up Upgrade {>Upgrade}
        
        # Health check
        health_uri /healthz
        health_interval 30s
        health_timeout 10s
    }
    
    # Security headers
    header {
        # Enable HSTS
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        
        # Prevent clickjacking
        X-Frame-Options "SAMEORIGIN"
        
        # Prevent MIME sniffing
        X-Content-Type-Options "nosniff"
        
        # XSS protection
        X-XSS-Protection "1; mode=block"
        
        # Referrer policy
        Referrer-Policy "strict-origin-when-cross-origin"
        
        # Remove server header
        -Server
    }
    
    # Logging
    log {
        output stdout
        format json
        level INFO
    }
}

# HTTP to HTTPS redirect for production
http://{$PUBLIC_DOMAIN:localhost} {
    redir https://{host}{uri} permanent
}