# Internal only (not in the browser URL):
# 9010 merchant API | 9011 exchange API | 9012 bank API
# 9013 bank landing | 9014 exchange landing | 9015 merchant landing
# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | 9025 paivana | 9200 forgejo-ssh
# 9090 tops ng1 | 9091 tops ng2 | 9092 tops ng3

{
    email info+koopa@hacktivism.ch
    http_port 9000
    https_port 9001
    auto_https disable_redirects
    # Caddy listens on 9001 behind VeciGate/https-proxy :443.
    # Default HTTP/3 would send Alt-Svc: h3=":9001" — break public HTTPS on :443.
    servers {
        protocols h1 h2
    }
}

(proxy_public) {
    header_up Host {host}
    header_up X-Forwarded-Host {host}
    header_up X-Forwarded-Proto {scheme}
    header_up X-Forwarded-Port 443
    header_down Location "^https?://[^/]+:90[0-9]{2}(.*)$" "https://{host}$1"
}

taler.hacktivism.ch {
    tls /etc/caddy/certs/taler.hacktivism.ch/fullchain.pem /etc/caddy/certs/taler.hacktivism.ch/privkey.pem
    header Alt-Svc "clear"

    # Public landing first
    redir / /intro/ 302

    handle /intro* {
        reverse_proxy 127.0.0.1:9015 {
            import proxy_public
        }
    }

    # surface + aptdeploy HTML (taler.hacktivism.ch only)
    handle /taler-monitoring-surface_err {
        redir /taler-monitoring-surface_err/ 302
    }
    handle /taler-monitoring-surface_err/ {
        root * /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-surface_err
        file_server
    }
    handle /taler-monitoring-surface {
        redir /taler-monitoring-surface/ 302
    }
    handle /taler-monitoring-surface/ {
        root * /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-surface
        file_server
    }
    handle /taler-monitoring-aptdeploy_err {
        redir /taler-monitoring-aptdeploy_err/ 302
    }
    handle /taler-monitoring-aptdeploy_err/ {
        root * /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-aptdeploy_err
        file_server
    }
    handle /taler-monitoring-aptdeploy {
        redir /taler-monitoring-aptdeploy/ 302
    }
    handle /taler-monitoring-aptdeploy/ {
        root * /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-aptdeploy
        file_server
    }

    handle /taler-monitoring-mattermost_err {
        redir /taler-monitoring-mattermost_err/ 302
    }
    handle /taler-monitoring-mattermost_err/ {
        root * /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-mattermost_err
        file_server
    }
    handle /taler-monitoring-mattermost {
        redir /taler-monitoring-mattermost/ 302
    }
    handle /taler-monitoring-mattermost/ {
        root * /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-mattermost
        file_server
    }

    handle /taler-monitoring-mail_err {
        redir /taler-monitoring-mail_err/ 302
    }
    handle /taler-monitoring-mail_err/ {
        root * /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-mail_err
        file_server
    }
    handle /taler-monitoring-mail {
        redir /taler-monitoring-mail/ 302
    }
    handle /taler-monitoring-mail/ {
        root * /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-mail
        file_server
    }

    # taler-monitoring console HTML (host static — not in app containers)
    handle /monitoring_err {
        redir /monitoring_err/ 302
    }
    handle /monitoring_err/ {
        root * /var/www/monitoring-sites/taler.hacktivism.ch/monitoring_err
        file_server
    }
    handle /monitoring {
        redir /monitoring/ 302
    }
    handle /monitoring/ {
        root * /var/www/monitoring-sites/taler.hacktivism.ch/monitoring
        file_server
    }




    # SPA: /webui → /webui/
    redir /webui /webui/ 302

    # Merchant API + WebUI (nginx :9010 → unix socket)
    reverse_proxy https://127.0.0.1:9010 {
        transport http {
            tls_insecure_skip_verify
        }
        import proxy_public
    }
}

exchange.hacktivism.ch {
    tls /etc/caddy/certs/exchange.hacktivism.ch/fullchain.pem /etc/caddy/certs/exchange.hacktivism.ch/privkey.pem
    header Alt-Svc "clear"

    # Public landing first
    redir / /intro/ 302

    handle /intro* {
        reverse_proxy 127.0.0.1:9014 {
            import proxy_public
        }
    }

    # taler-monitoring console HTML (host static — not in app containers)
    handle /monitoring_err {
        redir /monitoring_err/ 302
    }
    handle /monitoring_err/ {
        root * /var/www/monitoring-sites/exchange.hacktivism.ch/monitoring_err
        file_server
    }
    handle /monitoring {
        redir /monitoring/ 302
    }
    handle /monitoring/ {
        root * /var/www/monitoring-sites/exchange.hacktivism.ch/monitoring
        file_server
    }


    reverse_proxy 127.0.0.1:9011 {
        import proxy_public
    }
}

bank.hacktivism.ch {
    header Alt-Svc "clear"

    # Public landing first
    redir / /intro/ 302

    handle /intro* {
        reverse_proxy 127.0.0.1:9013 {
            import proxy_public
        }
    }

    # taler-monitoring console HTML (host static — not in app containers)
    handle /monitoring_err {
        redir /monitoring_err/ 302
    }
    handle /monitoring_err/ {
        root * /var/www/monitoring-sites/bank.hacktivism.ch/monitoring_err
        file_server
    }
    handle /monitoring {
        redir /monitoring/ 302
    }
    handle /monitoring/ {
        root * /var/www/monitoring-sites/bank.hacktivism.ch/monitoring
        file_server
    }


    # Static terms/privacy on landing nginx :9013
    handle /terms* {
        reverse_proxy 127.0.0.1:9013 {
            import proxy_public
        }
    }
    handle /privacy* {
        reverse_proxy 127.0.0.1:9013 {
            import proxy_public
        }
    }

    reverse_proxy 127.0.0.1:9012 {
        import proxy_public
    }
}

castopod.hacktivism.ch {
    header Alt-Svc "clear"
    reverse_proxy 127.0.0.1:9020 {
        header_up Host {host}
        header_up X-Forwarded-For {remote_host}
    }
}

bonfire.hacktivism.ch {
    header Alt-Svc "clear"
    reverse_proxy 127.0.0.1:9021 {
        header_up Host {host}
        header_up X-Forwarded-For {remote_host}
        flush_interval -1
    }
}

prime.hacktivism.ch {
    header Alt-Svc "clear"
    reverse_proxy 127.0.0.1:9022 {
        header_up Host {host}
        header_up X-Forwarded-For {remote_host}
        flush_interval -1
    }
}

bt.hacktivism.ch {
    header Alt-Svc "clear"
    reverse_proxy 127.0.0.1:9023 {
        header_up Host {host}
        header_up X-Forwarded-For {remote_host}
    }
}

# 9024 forgejo HTTP (SSH :9200 host-direct, not via Caddy)
git.hacktivism.ch {
    header Alt-Svc "clear"
    reverse_proxy 127.0.0.1:9024 {
        header_up Host {host}
        header_up X-Forwarded-For {remote_host}
        header_up X-Forwarded-Proto {scheme}
        flush_interval -1
        transport http {
            read_timeout 3600s
            write_timeout 3600s
        }
    }
}


# Taler Operations design previews (static nginx)
tops.ng1.hacktivism.ch {
	header Alt-Svc "clear"
	reverse_proxy 127.0.0.1:9090 {
		header_up Host {host}
		header_up X-Forwarded-For {remote_host}
		header_up X-Forwarded-Proto {scheme}
	}
}

tops.ng2.hacktivism.ch {
	header Alt-Svc "clear"
	reverse_proxy 127.0.0.1:9091 {
		header_up Host {host}
		header_up X-Forwarded-For {remote_host}
		header_up X-Forwarded-Proto {scheme}
	}
}

tops.ng3.hacktivism.ch {
	header Alt-Svc "clear"
	reverse_proxy 127.0.0.1:9092 {
		header_up Host {host}
		header_up X-Forwarded-For {remote_host}
		header_up X-Forwarded-Proto {scheme}
	}
}


# 9025 paivana-httpd (GOA paywall)
paivana.hacktivism.ch {
    header Alt-Svc "clear"
    reverse_proxy 127.0.0.1:9025 {
        header_up Host {host}
        header_up X-Forwarded-For {remote_host}
        header_up X-Forwarded-Host {host}
        header_up X-Forwarded-Proto {scheme}
        header_up X-Forwarded-Port 443
    }
}

http://taler.hacktivism.ch, http://exchange.hacktivism.ch, http://bank.hacktivism.ch, http://castopod.hacktivism.ch, http://bonfire.hacktivism.ch, http://prime.hacktivism.ch, http://bt.hacktivism.ch, http://git.hacktivism.ch, http://paivana.hacktivism.ch, http://tops.ng1.hacktivism.ch, http://tops.ng2.hacktivism.ch, http://tops.ng3.hacktivism.ch {
    handle /.well-known/acme-challenge/* {
        root * /var/www/acme
        file_server
    }
    handle {
        redir https://{host}{uri} permanent
    }
}
