301 from www to apex

ansible/files/Caddyfile.j2

@@ -1,4 +1,7 @@
-{{ www_host }} {
+# Canonical origin. Everything the site emits — og:url, robots.txt, the
+# sitemap, the GA4 property, vince_site_domain — already says mozimo.in, so
+# the apex serves and www is permanently redirected here (below).
+{{ apex_host }} {
 	# PocketBase Admin UI and REST API (files included)
 	redir /_ /_/
 	handle /_/* {
@@ -22,14 +25,20 @@
 	}
 }
 
+# www is a permanent (301) redirect to the canonical apex origin, so the same
+# page is never served from two hosts. {uri} carries the path and query string.
+{{ www_host }} {
+	redir https://{{ apex_host }}{uri} permanent
+}
+
 {{ cms_host }} {
 	redir / /_/
 	reverse_proxy {{ docker_container }}:{{ cms_port }}
 }
 
 # Vince analytics dashboard (login-protected). DNS for this host must point
-# at this server; the tracker script itself stays on the www host at
-# /stats/* — this is only for humans reading the dashboard.
+# at this server; the tracker script itself stays on the canonical apex host
+# at /stats/* — this is only for humans reading the dashboard.
 {{ stats_host }} {
 	reverse_proxy {{ vince_container }}:{{ vince_port }}
 }

ansible/vars/default.yml

@@ -8,6 +8,8 @@ tag: latest
 
 host_directory: "/var/lib/{{ title }}"
 
+# apex is the canonical origin and serves the app; www 301-redirects to it
+apex_host: "mozimo.in"
 www_host: "www.mozimo.in"
 www_port: 3000
 cms_host: "cms.mozimo.in"
@@ -30,7 +32,8 @@ vince_admin_password: "ChangeMe-Vince-2025!"
 vince_site_domain: mozimo.in
 stats_host: stats.mozimo.in
 
-# caddy publishes www (SSR + /api/* + /_/* -> pocketbase) and cms (admin)
+# caddy publishes the apex site (SSR + /api/* + /_/* -> pocketbase), redirects
+# www to it, and publishes the cms admin host
 
 caddy_container: caddy
 caddyfile_path: /var/lib/caddy/conf/Caddyfile