{
    # INFO, not DEBUG: at DEBUG Caddy logs every proxied request with its full URI, and the
    # SignalR hubs carry the user's JWT in the query string (?access_token=...), so the log
    # became a store of live sign-in tokens. Access logs stay off (no site-level `log`). If you
    # turn them on, strip the token:
    #   log {
    #       format filter {
    #           wrap console
    #           fields {
    #               request>uri query {
    #                   delete access_token
    #               }
    #           }
    #       }
    #   }
    log {
        output stdout
        format console
        level INFO
    }
}

{$MY_DOMAIN} {
    tls {
        dns cloudflare {$CLOUDFLARE_API_TOKEN}
    }

    # If path starts with /api/, proxy to backend, keeping /api/ in the path
    reverse_proxy /api/* api:8080 {
        header_up Host {host}
        header_up X-Forwarded-Host {host}
    }

    # Route media file requests directly to the API.
    # The API serves static files from its wwwroot, so /media/... should map to /app/wwwroot/media/...
    # This needs to come BEFORE the frontend proxy.
    reverse_proxy /media/* api:8080 {
        header_up Host {host}
        header_up X-Forwarded-Host {host}
    }

    # For all other paths, proxy to frontend
    reverse_proxy frontend:3000 {
        header_up Host {host}
        header_up X-Forwarded-Host {host}
    }
}

# Optional: HTTP to HTTPS redirect if Caddy doesn't handle it automatically for the primary domain block
# http://{$MY_DOMAIN} {
#    redir https://{$MY_DOMAIN}{uri}
# }
