{$HARAKA_DOMAIN:mail.example.com} {
  # Automatic HTTPS with Let's Encrypt
  # Caddy handles certificate generation and renewal automatically

  # Access logs
  log {
    output file /data/access.log
  }

  # Internal API endpoints are not exposed through the public Haraka Caddy edge.
  @api path /api/*
  handle @api {
    respond "Forbidden" 403
  }

  # Status, health, and metrics auth is enforced by Haraka itself.
  @ops path /status /healthz

  handle @ops {
    reverse_proxy {$HARAKA_HTTP_UPSTREAM:haraka-outbound:8080} {
      header_up X-Real-IP {remote_host}
    }
  }

  handle /metrics {
    reverse_proxy {$HARAKA_HTTP_UPSTREAM:haraka-outbound:8080} {
      header_up X-Real-IP {remote_host}
    }
  }

  # Default response for other paths
  respond "elektrine-haraka Email Server" 404
}

# HTTP redirect (automatic)
http://{$HARAKA_DOMAIN:mail.example.com} {
  redir https://{host}{uri} permanent
}