# --- Global Options ---
{
	# ACME DNS Challenge using Cloudflare. Token MUST be provided via ENV var.
	acme_dns cloudflare {$CADDY_CLOUDFLARE_API_TOKEN}

	# Default directive order
	order handle_errors last
}

# --- Reusable Snippets ---
(log_common) {
	log {
		output file /logs/caddy_access.log {
			roll_size 20mb
			roll_keep 5
		}
	}
}
(security_headers) {
	header {
		#	X-Frame-Options DENY
		X-Content-Type-Options nosniff
		-Server
	}
}
(encoding) {
	encode gzip zstd {
		minimum_length 128
	}
}
(proxy_headers) {
	# Common headers sent to backend for proxy awareness
	header_up Host {http.request.host}
	header_up X-Real-IP {http.request.remote.host}
	header_up X-Forwarded-For {http.request.remote.host}
	header_up X-Forwarded-Port {http.request.port}
	header_up X-Forwarded-Proto {http.request.scheme}
}

# --- Localhost Test Site ---
# Useful for checking if Caddy itself is running correctly on its host/container.
localhost {
	import log_common
	import encoding
	respond "Hello, world from Caddy!"
}

# --- Main Wildcard Site Block ---
# Handles all *.{$DOMAIN_NETWORK} requests with a single wildcard certificate.
*.{$DOMAIN_NETWORK} {
	# Apply logging and encoding to ALL requests entering this block
	import log_common
	import encoding

	# --- Define Host Matchers  ---
	@dozzle host dozzle.{$DOMAIN_NETWORK}
	@glance host glance.{$DOMAIN_NETWORK}
	@pve host pve.{$DOMAIN_NETWORK}
	@pbs host pbs.{$DOMAIN_NETWORK}
	@nas host nas.{$DOMAIN_NETWORK}
	@radarr host radarr.{$DOMAIN_NETWORK}
	@sonarr host sonarr.{$DOMAIN_NETWORK}
	@sync host sync.{$DOMAIN_NETWORK}
	@home host home.{$DOMAIN_NETWORK}
	@homepage host homepage.{$DOMAIN_NETWORK}
	@grafana host grafana.{$DOMAIN_NETWORK}
	@influxdb host influxdb.{$DOMAIN_NETWORK}
	@prometheus host prometheus.{$DOMAIN_NETWORK}
	@overseerr host overseerr.{$DOMAIN_NETWORK}
	@plex host plex.{$DOMAIN_NETWORK}
	@kavita host kavita.{$DOMAIN_NETWORK}
	@abs host abs.{$DOMAIN_NETWORK}
	@paperless host paperless.{$DOMAIN_NETWORK}
	@teslamate host teslamate.{$DOMAIN_NETWORK}
	@irc host irc.{$DOMAIN_NETWORK}
	@tesla host tesla.{$DOMAIN_NETWORK} # TODO: Uses hardcoded IP below. SOrt it out later.
	@hoarder host hoarder.{$DOMAIN_NETWORK}
	@etv host etv.{$DOMAIN_NETWORK}

	# --- Handle Requests - Grouped by Target Host IP Variable ---

	# --- Services on Localhost / Caddy Host ---
	handle @dozzle {
		import security_headers

		reverse_proxy {$LOCAL_IP}:{$PORT_DOZZLE}
	}

	handle @pve {
		import security_headers # Apply standard security headers

		# Reverse proxy to the Proxmox VE cluster nodes.
		reverse_proxy https://{$IP_PVE_1}:8006 https://{$IP_PVE_2}:8006 https://{$IP_PVE_3}:8006 https://{$IP_PVE_4}:8006 https://{$IP_PVE_5}:8006 {
			# Load Balancing Policy
			lb_policy first


			# Transport Layer Security (for actual proxy requests)
			transport http {
				tls_insecure_skip_verify
			}

			# Standard Proxy Headers
			import proxy_headers
		}
	}
	# --- Services on Proxmox Backup Server ({$IP_PBS}) ---
	handle @pbs {
		import security_headers
		reverse_proxy https://{$IP_PBS}:8007 {
			transport http {
				tls_insecure_skip_verify
			}
			import proxy_headers
		}
	}

	# --- Services on Home Assistant ({$IP_HASS}) ---
	handle @home {
		import security_headers
		reverse_proxy http://{$IP_HASS}:8123 {
			# transport http { versions h2c 2 } # TODO: needs more testing. Optional http/2
			# Required headers for HA Websockets
			header_up Connection {header.Connection}
			header_up Upgrade {header.Upgrade}
		}
	}

	# --- Services on Synology ({$IP_SYNOLOGY}) ---
	handle @nas {
		import security_headers
		reverse_proxy https://{$IP_SYNOLOGY}:5001 {
			transport http {
				tls_insecure_skip_verify
			}
			header_up Host {upstream_hostport} #Required?
			header_up X-Real-IP {http.request.remote.host}
			header_up X-Forwarded-For {http.request.remote.host}
			header_up X-Forwarded-Proto {http.request.scheme}
		}
	}
	handle @radarr {
		import security_headers
		reverse_proxy {$IP_SYNOLOGY}:7878
	}
	handle @sonarr {
		import security_headers
		reverse_proxy {$IP_SYNOLOGY}:8989 {
			# Sonarr specific headers if needed (e.g., for base path)
			header_up X-Real-IP {http.request.remote.host}
			header_up X-Forwarded-For {http.request.remote.host}
			header_up X-Forwarded-Proto {http.request.scheme}
		}
	}
	handle @sync {
		import security_headers
		reverse_proxy {$IP_SYNOLOGY}:8384
	}

	# --- Services on 'Moriarty' ({$IP_MORIARTY}) ---
	handle @glance {
		import security_headers
		reverse_proxy {$IP_MORIARTY}:8254
	}
	handle @homepage {
		import security_headers
		reverse_proxy {$IP_MORIARTY}:3003
	}
	handle @kavita {
		import security_headers
		reverse_proxy {$IP_MORIARTY}:5454
	}
	handle @abs {
		# Audiobookshelf
		import security_headers
		reverse_proxy {$IP_MORIARTY}:13378
	}
	handle @paperless {
		import security_headers
		reverse_proxy {$IP_MORIARTY}:8000
	}
	handle @teslamate {
		import security_headers
		reverse_proxy {$IP_MORIARTY}:4000
	}
	handle @irc {
		# Assuming Web IRC client
		import security_headers
		reverse_proxy {$IP_MORIARTY}:9909
	}
	handle @hoarder {
		import security_headers
		reverse_proxy {$IP_MORIARTY}:3693
	}

	# --- Services on 'Curie' ({$IP_CURIE}) ---
	handle @grafana {
		import security_headers
		reverse_proxy {$IP_CURIE}:3010 {
			# NOTE: Do i need to keep for this setup?
			header_up X-WEBAUTH-USER admin
		}
	}
	handle @influxdb {
		import security_headers
		# NOTE: Ensure InfluxDB has authentication enabled!
		reverse_proxy {$IP_CURIE}:8086
	}
	handle @prometheus {
		import security_headers
		reverse_proxy {$IP_CURIE}:9090
	}

	# --- Services on 'ThreeDog' ({$IP_THREEDOG}) ---
	handle @overseerr {
		import security_headers
		reverse_proxy {$IP_THREEDOG}:5055 {
			import proxy_headers
		}
	}
	handle @plex {
		# NOTE: No 'import security_headers'
		reverse_proxy {$IP_THREEDOG}:32400
	}
	handle @etv {
		# ErsatzTV
		import security_headers
		reverse_proxy {$IP_THREEDOG}:8409
	}

	# --- Services on Other Hosts (Hardcoded IP) ---
	handle @tesla {
		# Powerwall Tests
		import security_headers
		# No ENV var provided for this one, using hardcoded IP
		reverse_proxy 10.10.40.220:9000
	}

	# --- Fallback for Unmatched Subdomains ---
	# Catches any *.{$DOMAIN_NETWORK} request not matching above handles.
	# Inherits log/encoding from the top level of the site block.
	handle {
		respond "Service not configured or subdomain not found for {http.request.host}" 404
	}
}