# Internal only (not in the browser URL):
# 9010 merchant API | 9011 exchange API | 9012 bank API
# 9013 bank landing | 9014 exchange landing | 9015 merchant landing
# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | 9025 paivana | 9026 lemmy | 9027 decidim | 9029 galene | 9030 cryptpad | 9031 meet | 9032 bbb | 9200 forgejo-ssh
# 9090 tops ng1 | 9091 tops ng2 | 9092 tops ng3

{
    email info+koopa@hacktivism.ch
    http_port 9000
    https_port 9001
    auto_https disable_redirects
    # Caddy listens on 9001 behind VeciGate/https-proxy :443.
    # Default HTTP/3 would send Alt-Svc: h3=":9001" — break public HTTPS on :443.
    servers {
        protocols h1 h2
    }
}

(proxy_public) {
    header_up Host {host}
    header_up X-Forwarded-Host {host}
    header_up X-Forwarded-Proto {scheme}
    header_up X-Forwarded-Port 443
    header_down Location "^https?://[^/]+:90[0-9]{2}(.*)$" "https://{host}$1"
}

taler.hacktivism.ch {
    tls /etc/caddy/certs/taler.hacktivism.ch/fullchain.pem /etc/caddy/certs/taler.hacktivism.ch/privkey.pem
    header Alt-Svc "clear"

    # Public landing first
    redir / /intro/ 302

    handle /intro* {
        reverse_proxy 127.0.0.1:9015 {
            import proxy_public
        }
    }

    # surface + aptdeploy HTML (taler.hacktivism.ch only)
    handle /taler-monitoring-surface_err {
        redir /taler-monitoring-surface_err/ 302
    }
    handle /taler-monitoring-surface_err* {
        root * /var/www/monitoring-sites/taler.hacktivism.ch
        file_server
    }
    handle /taler-monitoring-surface {
        redir /taler-monitoring-surface/ 302
    }
    handle /taler-monitoring-surface* {
        root * /var/www/monitoring-sites/taler.hacktivism.ch
        file_server
    }
    handle /taler-monitoring-aptdeploy_err {
        redir /taler-monitoring-aptdeploy_err/ 302
    }
    handle /taler-monitoring-aptdeploy_err* {
        root * /var/www/monitoring-sites/taler.hacktivism.ch
        file_server
    }
    handle /taler-monitoring-aptdeploy {
        redir /taler-monitoring-aptdeploy/ 302
    }
    handle /taler-monitoring-aptdeploy* {
        root * /var/www/monitoring-sites/taler.hacktivism.ch
        file_server
    }

    handle /taler-monitoring-mattermost_err {
        redir /taler-monitoring-mattermost_err/ 302
    }
    handle /taler-monitoring-mattermost_err* {
        root * /var/www/monitoring-sites/taler.hacktivism.ch
        file_server
    }
    handle /taler-monitoring-mattermost {
        redir /taler-monitoring-mattermost/ 302
    }
    handle /taler-monitoring-mattermost* {
        root * /var/www/monitoring-sites/taler.hacktivism.ch
        file_server
    }

    handle /taler-monitoring-mail_err {
        redir /taler-monitoring-mail_err/ 302
    }
    handle /taler-monitoring-mail_err* {
        root * /var/www/monitoring-sites/taler.hacktivism.ch
        file_server
    }
    handle /taler-monitoring-mail {
        redir /taler-monitoring-mail/ 302
    }
    handle /taler-monitoring-mail* {
        root * /var/www/monitoring-sites/taler.hacktivism.ch
        file_server
    }

    # taler-monitoring console HTML (host static — not in app containers)
    handle /monitoring_err {
        redir /monitoring_err/ 302
    }
    handle /monitoring_err* {
        root * /var/www/monitoring-sites/taler.hacktivism.ch
        file_server
    }
    handle /monitoring {
        redir /monitoring/ 302
    }
    handle /monitoring* {
        root * /var/www/monitoring-sites/taler.hacktivism.ch
        file_server
    }




    # SPA: /webui → /webui/
    redir /webui /webui/ 302

    # Merchant API + WebUI (nginx :9010 → unix socket)
    reverse_proxy https://127.0.0.1:9010 {
        transport http {
            tls_insecure_skip_verify
        }
        import proxy_public
    }
}

exchange.hacktivism.ch {
    tls /etc/caddy/certs/exchange.hacktivism.ch/fullchain.pem /etc/caddy/certs/exchange.hacktivism.ch/privkey.pem
    header Alt-Svc "clear"

    # Public landing first
    redir / /intro/ 302

    handle /intro* {
        reverse_proxy 127.0.0.1:9014 {
            import proxy_public
        }
    }

    # taler-monitoring console HTML (host static — not in app containers)
    handle /monitoring_err {
        redir /monitoring_err/ 302
    }
    handle /monitoring_err* {
        root * /var/www/monitoring-sites/exchange.hacktivism.ch
        file_server
    }
    handle /monitoring {
        redir /monitoring/ 302
    }
    handle /monitoring* {
        root * /var/www/monitoring-sites/exchange.hacktivism.ch
        file_server
    }


    reverse_proxy 127.0.0.1:9011 {
        import proxy_public
    }
}

bank.hacktivism.ch {
    header Alt-Svc "clear"

    # Public landing first
    redir / /intro/ 302

    handle /intro* {
        reverse_proxy 127.0.0.1:9013 {
            import proxy_public
        }
    }

    # taler-monitoring console HTML (host static — not in app containers)
    handle /monitoring_err {
        redir /monitoring_err/ 302
    }
    handle /monitoring_err* {
        root * /var/www/monitoring-sites/bank.hacktivism.ch
        file_server
    }
    handle /monitoring {
        redir /monitoring/ 302
    }
    handle /monitoring* {
        root * /var/www/monitoring-sites/bank.hacktivism.ch
        file_server
    }


    # Static terms/privacy on landing nginx :9013
    handle /terms* {
        reverse_proxy 127.0.0.1:9013 {
            import proxy_public
        }
    }
    handle /privacy* {
        reverse_proxy 127.0.0.1:9013 {
            import proxy_public
        }
    }

    reverse_proxy 127.0.0.1:9012 {
        import proxy_public
    }
}

castopod.hacktivism.ch {
    header Alt-Svc "clear"
    reverse_proxy 127.0.0.1:9020 {
        header_up Host {host}
        header_up X-Forwarded-For {remote_host}
    }
}

bonfire.hacktivism.ch {
    header Alt-Svc "clear"
    reverse_proxy 127.0.0.1:9021 {
        header_up Host {host}
        header_up X-Forwarded-For {remote_host}
        flush_interval -1
    }
}

prime.hacktivism.ch {
    header Alt-Svc "clear"
    reverse_proxy 127.0.0.1:9022 {
        header_up Host {host}
        header_up X-Forwarded-For {remote_host}
        flush_interval -1
    }
}

bt.hacktivism.ch {
    header Alt-Svc "clear"
    reverse_proxy 127.0.0.1:9023 {
        header_up Host {host}
        header_up X-Forwarded-For {remote_host}
    }
}

# 9024 forgejo HTTP (SSH :9200 host-direct, not via Caddy)
git.hacktivism.ch {
    header Alt-Svc "clear"
    reverse_proxy 127.0.0.1:9024 {
        header_up Host {host}
        header_up X-Forwarded-For {remote_host}
        header_up X-Forwarded-Proto {scheme}
        flush_interval -1
        transport http {
            read_timeout 3600s
            write_timeout 3600s
        }
    }
}


# Taler Operations design previews (static nginx)
tops.ng1.hacktivism.ch {
	header Alt-Svc "clear"
	reverse_proxy 127.0.0.1:9090 {
		header_up Host {host}
		header_up X-Forwarded-For {remote_host}
		header_up X-Forwarded-Proto {scheme}
	}
}

tops.ng2.hacktivism.ch {
	header Alt-Svc "clear"
	reverse_proxy 127.0.0.1:9091 {
		header_up Host {host}
		header_up X-Forwarded-For {remote_host}
		header_up X-Forwarded-Proto {scheme}
	}
}

tops.ng3.hacktivism.ch {
	header Alt-Svc "clear"
	reverse_proxy 127.0.0.1:9092 {
		header_up Host {host}
		header_up X-Forwarded-For {remote_host}
		header_up X-Forwarded-Proto {scheme}
	}
}


# 9025 paivana-httpd (GOA paywall)
paivana.hacktivism.ch {
    header Alt-Svc "clear"
    reverse_proxy 127.0.0.1:9025 {
        header_up Host {host}
        header_up X-Forwarded-For {remote_host}
        header_up X-Forwarded-Host {host}
        header_up X-Forwarded-Proto {scheme}
        header_up X-Forwarded-Port 443
    }
}

# 9026 lemmy (+ ui/pictrs via internal nginx)
lemmy.hacktivism.ch {
    header Alt-Svc "clear"
    reverse_proxy 127.0.0.1:9026 {
        header_up Host {host}
        header_up X-Forwarded-For {remote_host}
        header_up X-Forwarded-Proto {scheme}
        flush_interval -1
        transport http {
            read_timeout 3600s
            write_timeout 3600s
        }
    }
}

# 9027 decidim (rails)
decidim.hacktivism.ch {
    header Alt-Svc "clear"
    reverse_proxy 127.0.0.1:9027 {
        header_up Host {host}
        header_up X-Forwarded-For {remote_host}
        header_up X-Forwarded-Host {host}
        header_up X-Forwarded-Proto {scheme}
        header_up X-Forwarded-Port 443
        flush_interval -1
        transport http {
            read_timeout 3600s
            write_timeout 3600s
        }
    }
}

# 9029 galene — allocated 2026-09-08
# Merge: scripts/caddy/caddy-apply.sh --site galene.hacktivism.ch --port 9029 --label galene
galene.hacktivism.ch {
	header Alt-Svc "clear"
	reverse_proxy 127.0.0.1:9029 {
		header_up Host {host}
		header_up X-Forwarded-For {remote_host}
		header_up X-Forwarded-Host {host}
		header_up X-Forwarded-Proto {scheme}
		header_up X-Forwarded-Port 443
		flush_interval -1
		transport http {
			read_timeout 3600s
			write_timeout 3600s
		}
	}
}

# 9030 cryptpad — allocated 2026-09-08
# Merge: scripts/caddy/caddy-apply.sh --site cryptpad.hacktivism.ch --port 9030 --label cryptpad
# CryptPad also needs sandbox subdomain (cryptpad-ui / sandbox) — wire after first boot.
cryptpad.hacktivism.ch {
	header Alt-Svc "clear"
	reverse_proxy 127.0.0.1:9030 {
		header_up Host {host}
		header_up X-Forwarded-For {remote_host}
		header_up X-Forwarded-Host {host}
		header_up X-Forwarded-Proto {scheme}
		header_up X-Forwarded-Port 443
		flush_interval -1
		transport http {
			read_timeout 3600s
			write_timeout 3600s
		}
	}
}

# 9031 meet (Jitsi) — allocated 2026-09-08
# Merge: scripts/caddy/caddy-apply.sh --site meet.hacktivism.ch --port 9031 --label meet
# WebRTC media (UDP/JVB) is separate from this HTTPS vhost — VeciGate/firewall later.
meet.hacktivism.ch {
	header Alt-Svc "clear"
	reverse_proxy 127.0.0.1:9031 {
		header_up Host {host}
		header_up X-Forwarded-For {remote_host}
		header_up X-Forwarded-Host {host}
		header_up X-Forwarded-Proto {scheme}
		header_up X-Forwarded-Port 443
		flush_interval -1
		transport http {
			read_timeout 3600s
			write_timeout 3600s
		}
	}
}

# 9032 bbb (BigBlueButton) — allocated 2026-09-08
# Merge: scripts/caddy/caddy-apply.sh --site bbb.hacktivism.ch --port 9032 --label bbb
# Stack image base: Ubuntu (not CachyOS). Media/UDP ports TBD with install.
bbb.hacktivism.ch {
	header Alt-Svc "clear"
	reverse_proxy 127.0.0.1:9032 {
		header_up Host {host}
		header_up X-Forwarded-For {remote_host}
		header_up X-Forwarded-Host {host}
		header_up X-Forwarded-Proto {scheme}
		header_up X-Forwarded-Port 443
		flush_interval -1
		transport http {
			read_timeout 3600s
			write_timeout 3600s
		}
	}
}

http://taler.hacktivism.ch, http://exchange.hacktivism.ch, http://bank.hacktivism.ch, http://castopod.hacktivism.ch, http://bonfire.hacktivism.ch, http://prime.hacktivism.ch, http://bt.hacktivism.ch, http://git.hacktivism.ch, http://paivana.hacktivism.ch, http://tops.ng1.hacktivism.ch, http://tops.ng2.hacktivism.ch, http://tops.ng3.hacktivism.ch, http://lemmy.hacktivism.ch, http://decidim.hacktivism.ch, http://galene.hacktivism.ch, http://cryptpad.hacktivism.ch, http://meet.hacktivism.ch, http://bbb.hacktivism.ch {
    handle /.well-known/acme-challenge/* {
        root * /var/www/acme
        file_server
    }
    handle {
        redir https://{host}{uri} permanent
    }
}