# Upload — Filestash player file share (filestash service). Shared login,
# writable. See plan/20-files.md.
#
# Filestash blocks any request whose Host header doesn't match its configured
# `general.host` (https://upload.${BASE_DOMAIN}), with "only traffic from X is
# allowed". The host nginx forwards the original Host, and caddy passes it
# through untouched — do NOT rewrite it here or every request 403s.
#
# Filestash CANNOT be served under a subpath (SPA hardcodes /api, /assets, /login
# at root), so it gets its own subdomain. The read-only browse of the same share
# lives at files.${BASE_DOMAIN} (62-files.caddy).
http://upload.{$BASE_DOMAIN} {
	reverse_proxy filestash:8334
}