# Caddy's global options for an instance behind HAProxy (ADR 0039, D10, D11), which
# compose.forwarded.yaml mounts into /etc/caddy/global/ and the Caddyfile's global
# options import.

servers {
	listener_wrappers {
		# The visitor's address from HAProxy's PROXY header, trusted from ramiel's
		# tunnel address alone (where Docker hands its connections on unchanged),
		# so the servers' per-network limits count visitors, not ramiel.
		proxy_protocol {
			timeout 5s
			allow 10.61.97.1/32
		}
		tls
	}
	# HTTP/3 runs over UDP, which HAProxy doesn't route: none, so no client is sent
	# looking for it at ramiel, whose UDP 443 is its own Caddy's.
	protocols h1 h2
}

# Certificates through the TLS-ALPN challenge alone, which reaches here through
# HAProxy unopened; port 80 isn't published, as ramiel answers it.
cert_issuer acme {
	disable_http_challenge
}