halkyon/deploy/Caddyfile

# Caddy forwards to the API server, and the assistant connector's paths (ADR 0006) to
# the web server (8082), which serves nothing else. Insights (8081) doesn't run in
# production; if it is ever re-enabled, reach it through an SSH tunnel, never through
# this file.
#
# {$DOMAIN} is `learn.halkyon.eu` on sahaquiel, where Caddy obtains and renews a
# Let's Encrypt certificate by itself, and `http://localhost` for the local rehearsal.
{$DOMAIN} {
	encode zstd gzip

	# The assistant connector: the MCP endpoint, its OAuth pages, and their metadata.
	@connector path /mcp /oauth/* /.well-known/oauth-protected-resource /.well-known/oauth-protected-resource/* /.well-known/oauth-authorization-server
	handle @connector {
		reverse_proxy server:8082
	}

	# Serverpod's streaming methods use WebSockets; reverse_proxy upgrades them as-is.
	handle {
		reverse_proxy server:8080
	}
}