# BRouter Caddy sidecar.
#
# Role: enforce the X-BRouter-Auth shared-secret header so the exposed
# vSwitch port can only be used by the Planner, not by any other process
# that happens to land on the private network.
#
# Note on auth hygiene: by default, Caddy's access log does NOT include
# request headers, so the token value is not written to disk. If you
# ever enable `log { format json }` with `fields_exclude`, make sure
# `X-BRouter-Auth` is NOT added to the log's request headers set.

{
	# Bind admin socket to localhost only (default behavior, explicit here
	# as defense-in-depth).
	admin localhost:2019
	# Don't attempt TLS — we only listen on the private vSwitch and
	# terminate plain HTTP on :17777. No certs, no Let's Encrypt, no
	# leakage of this hostname to the ACME CAs.
	auto_https off
}

:17777 {
	# Match requests carrying the correct shared secret.
	@authed header X-BRouter-Auth {$BROUTER_AUTH_TOKEN}

	handle @authed {
		# POI index artifact + manifest published by poi-extract.sh. Served
		# read-only from the mounted publish dir; the flagship import job
		# pulls /poi/manifest.json and /poi/pois.ndjson.gz over the vSwitch.
		# Same auth + vSwitch-only binding as BRouter, so it's unreachable
		# from the public internet.
		handle_path /poi/* {
			root * /srv/poi
			file_server
		}

		handle {
			reverse_proxy brouter:17777 {
				# Don't forward the auth header upstream — BRouter doesn't
				# use it, and it's cleaner to contain the credential at
				# the proxy boundary.
				header_up -X-BRouter-Auth
			}
		}
	}

	# Everything else: blunt 403.
	handle {
		respond "Forbidden" 403
	}

	# Access log to stdout (structured JSON). Container logs are captured
	# by Docker's json-file driver and shipped to Loki by the promtail
	# sidecar. Header values are NOT logged unless explicitly configured.
	log {
		output stdout
		format json
	}
}