# Static toggle — apex landing page + launcher downloads.
# Mounted only when the stack runs with static files (build-stack.sh up static|full).
http://{$BASE_DOMAIN} {
	# Caddy's local CA root, so guests can trust the air-gap HTTPS mirror.
	# Mounted from ./caddy/caddy-root-ca.crt (exported by build-stack prep;
	# the live pki dir is root-only 0600 and can't be served directly).
	handle /ca.crt {
		root * /srv/ca-pub
		file_server
	}
	# Launcher downloads are a sibling mount (/srv/launcher), not nested under
	# the read-only /srv/www. handle_path strips the /launcher prefix.
	handle_path /launcher/* {
		root * /srv/launcher
		file_server browse
	}
	handle {
		root * /srv/www
		file_server
	}
}