# Read-only static browse of the same share (files.) — caddy serves the dir
# listing, no auth. Read-only, so no upload tuning: standard 4m body is fine.
#
# Rendered into ulicraft-caddy.conf.tmpl at ${FILES_BROWSE_SERVER} by
# render-nginx.sh, ONLY when FILES_BROWSE=on. With `off` the placeholder
# collapses to a comment, so the name has no TLS vhost at all (and needs no
# cert — drop `files` from LE_SUBDOMAINS on that host).
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name files.${BASE_DOMAIN};

    ssl_certificate     ${APP_DIR}/certs/files.${BASE_DOMAIN}/cert.pem;
    ssl_certificate_key ${APP_DIR}/certs/files.${BASE_DOMAIN}/key.pem;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    location / {
        proxy_pass http://ulicraft_caddy;
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}