{
	email {$ACME_EMAIL:admin@example.com}
	storage file_system /data/caddy

	on_demand_tls {
		ask {$CADDY_ASK_URL}
	}

	auto_https disable_redirects

	servers :443 {
		trusted_proxies static 192.0.2.0/32 {$CADDY_TRUSTED_PROXY_CIDRS:}
		trusted_proxies_strict
		client_ip_headers X-Forwarded-For X-Real-IP
	}

	servers :80 {
		trusted_proxies static 192.0.2.0/32 {$CADDY_TRUSTED_PROXY_CIDRS:}
		trusted_proxies_strict
		client_ip_headers X-Forwarded-For X-Real-IP
	}
}

(admin_netbird_gate) {
	@admin_off_vpn {
		host {$CADDY_ADMIN_HOST:admin.elektrine.com}
		not remote_ip {$NETBIRD_ALLOWED_CIDRS:192.0.2.0/32}
	}
	respond @admin_off_vpn "Not Found" 404
}

{$CADDY_MANAGED_SITE_1} {
	header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
	import admin_netbird_gate
	respond /_edge/* "Not Found" 404

	reverse_proxy {$ORIGIN_UPSTREAM:app:8080} {
		header_up Host {host}
		header_up X-Forwarded-Proto https
		header_up X-Forwarded-For {client_ip}
		header_up X-Real-IP {client_ip}
	}
}

# elektrine:site2:start
{$CADDY_MANAGED_SITE_2} {
	header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
	import admin_netbird_gate
	respond /_edge/* "Not Found" 404

	reverse_proxy {$ORIGIN_UPSTREAM:app:8080} {
		header_up Host {host}
		header_up X-Forwarded-Proto https
		header_up X-Forwarded-For {client_ip}
		header_up X-Real-IP {client_ip}
	}
}
# elektrine:site2:end

https:// {
	tls {
		on_demand
	}

	header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
	import admin_netbird_gate
	respond /_edge/* "Not Found" 404

	reverse_proxy {$ORIGIN_UPSTREAM:app:8080} {
		header_up Host {host}
		header_up X-Forwarded-Proto https
		header_up X-Forwarded-For {client_ip}
		header_up X-Real-IP {client_ip}
	}
}

:80 {
	import admin_netbird_gate
	redir https://{host}{uri} 308
}
