# Canonical origin. Everything the site emits — og:url, robots.txt, the
# sitemap, the GA4 property, vince_site_domain — already says mozimo.in, so
# the apex serves and www is permanently redirected here (below).
#
# Upstreams are container names on {{ network_quadlet }}.network: Caddy
# resolves them through podman's DNS because it has joined that network.
{{ apex_host }} {
	# PocketBase Admin UI and REST API (files included)
	redir /_ /_/
	handle /_/* {
		reverse_proxy {{ app_container }}:{{ cms_port }}
	}
	handle /api/* {
		reverse_proxy {{ app_container }}:{{ cms_port }}
	}

	# First-party analytics (Vince) — the tracker script and event endpoint
	# are proxied same-origin with the /stats prefix stripped (vince serves
	# /js/script.js and /api/event), so they survive ad blockers and never
	# touch a third-party domain.
	handle_path /stats/* {
		reverse_proxy {{ vince_container }}:{{ vince_port }}
	}

	# TanStack Start frontend
	handle {
		reverse_proxy {{ app_container }}:{{ www_port }}
	}
}

# www is a permanent (301) redirect to the canonical apex origin, so the same
# page is never served from two hosts. {uri} carries the path and query string.
{{ www_host }} {
	redir https://{{ apex_host }}{uri} permanent
}

{{ cms_host }} {
	redir / /_/
	reverse_proxy {{ app_container }}:{{ cms_port }}
}

# Vince analytics dashboard (login-protected). DNS for this host must point
# at this server; the tracker script itself stays on the canonical apex host
# at /stats/* — this is only for humans reading the dashboard.
{{ stats_host }} {
	reverse_proxy {{ vince_container }}:{{ vince_port }}
}