From 4a3863a8092457fee2ac4107ba74364d77297860 Mon Sep 17 00:00:00 2001
From: Amritanshu <git@tanshu.com>
Date: Tue, 13 Oct 2026 12:18:44 +0000
Subject: [PATCH] 301 from www to apex

---
 ansible/files/Caddyfile.j2 | 15 ++++++++++++---
 ansible/vars/default.yml   |  5 ++++-
 2 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/ansible/files/Caddyfile.j2 b/ansible/files/Caddyfile.j2
index ac2560a..062e475 100644
--- a/ansible/files/Caddyfile.j2
+++ b/ansible/files/Caddyfile.j2
@@ -1,4 +1,7 @@
-{{ www_host }} {
+# Canonical origin. Everything the site emits — og:url, robots.txt, the
+# sitemap, the GA4 property, vince_site_domain — already says mozimo.in, so
+# the apex serves and www is permanently redirected here (below).
+{{ apex_host }} {
 	# PocketBase Admin UI and REST API (files included)
 	redir /_ /_/
 	handle /_/* {
@@ -22,14 +25,20 @@
 	}
 }
 
+# www is a permanent (301) redirect to the canonical apex origin, so the same
+# page is never served from two hosts. {uri} carries the path and query string.
+{{ www_host }} {
+	redir https://{{ apex_host }}{uri} permanent
+}
+
 {{ cms_host }} {
 	redir / /_/
 	reverse_proxy {{ docker_container }}:{{ cms_port }}
 }
 
 # Vince analytics dashboard (login-protected). DNS for this host must point
-# at this server; the tracker script itself stays on the www host at
-# /stats/* — this is only for humans reading the dashboard.
+# at this server; the tracker script itself stays on the canonical apex host
+# at /stats/* — this is only for humans reading the dashboard.
 {{ stats_host }} {
 	reverse_proxy {{ vince_container }}:{{ vince_port }}
 }
diff --git a/ansible/vars/default.yml b/ansible/vars/default.yml
index 44737fa..1fb0224 100644
--- a/ansible/vars/default.yml
+++ b/ansible/vars/default.yml
@@ -8,6 +8,8 @@ tag: latest
 
 host_directory: "/var/lib/{{ title }}"
 
+# apex is the canonical origin and serves the app; www 301-redirects to it
+apex_host: "mozimo.in"
 www_host: "www.mozimo.in"
 www_port: 3000
 cms_host: "cms.mozimo.in"
@@ -30,7 +32,8 @@ vince_admin_password: "ChangeMe-Vince-2025!"
 vince_site_domain: mozimo.in
 stats_host: stats.mozimo.in
 
-# caddy publishes www (SSR + /api/* + /_/* -> pocketbase) and cms (admin)
+# caddy publishes the apex site (SSR + /api/* + /_/* -> pocketbase), redirects
+# www to it, and publishes the cms admin host
 
 caddy_container: caddy
 caddyfile_path: /var/lib/caddy/conf/Caddyfile