301 from www to apex

ansible/files/Caddyfile.j2

@@ -1,4 +1,7 @@
-{{ www_host }} {
+# Canonical origin. Everything the site emits — og:url, robots.txt, the
+# sitemap, the GA4 property, vince_site_domain — already says mozimo.in, so
+# the apex serves and www is permanently redirected here (below).
+{{ apex_host }} {
 	# PocketBase Admin UI and REST API (files included)
 	redir /_ /_/
 	handle /_/* {
@@ -22,14 +25,20 @@
 	}
 }
 
+# www is a permanent (301) redirect to the canonical apex origin, so the same
+# page is never served from two hosts. {uri} carries the path and query string.
+{{ www_host }} {
+	redir https://{{ apex_host }}{uri} permanent
+}
+
 {{ cms_host }} {
 	redir / /_/
 	reverse_proxy {{ docker_container }}:{{ cms_port }}
 }
 
 # Vince analytics dashboard (login-protected). DNS for this host must point
-# at this server; the tracker script itself stays on the www host at
-# /stats/* — this is only for humans reading the dashboard.
+# at this server; the tracker script itself stays on the canonical apex host
+# at /stats/* — this is only for humans reading the dashboard.
 {{ stats_host }} {
 	reverse_proxy {{ vince_container }}:{{ vince_port }}
 }