# auto_https off would disable TLS entirely, breaking `tls internal` for the
# air-gap mirror vhosts. disable_redirects keeps the apex/auth/packwiz sites
# plaintext on :80 (they use explicit http://) while still allowing internal
# TLS on the mirror hosts below.
{
	auto_https disable_redirects
}

http://{$BASE_DOMAIN} {
	root * /srv/www
	file_server
}

http://auth.{$BASE_DOMAIN} {
	reverse_proxy drasl:25585
}

http://packwiz.{$BASE_DOMAIN} {
	root * /srv/pack
	file_server browse
}

# Full client air-gap mirror (see plan/11-full-airgap-mirror.md): byte-exact
# copies of the real upstream hosts served over HTTPS with Caddy's local CA.
# dnsmasq spoofs these hostnames -> our host; the {host} placeholder roots each
# hostname at its own mirror subtree. Guests import the Caddy root CA once.
meta.prismlauncher.org, piston-meta.mojang.com, piston-data.mojang.com, libraries.minecraft.net, maven.neoforged.net, resources.download.minecraft.net {
	tls internal
	root * /srv/mirror/{host}
	file_server
}
