# Monitor — admin-only latest.log stream (monitor service). Read-only: the UI
# only ever issues GETs, and the service exposes no mutating route at all.
# Full design: plan/23-monitor.md.
#
# basic_auth here IS the access control. The monitor container has no auth of
# its own and publishes no port, so caddy is the only path to it — there is no
# second door to also lock.
#
# The hash must be BCRYPT (`caddy hash-password`). Note this is the OPPOSITE of
# filestash (60-upload.caddy / plan/20-files.md), which only accepts $6$ and
# silently rejects bcrypt. Do not copy a hash between the two services.
#
# No path is exempted. Uptime Kuma probes /healthz as http://monitor:8080/healthz
# over mcnet, bypassing caddy entirely, so the whole vhost stays gated.
http://monitor.{$BASE_DOMAIN} {
	basic_auth {
		{$MONITOR_USER} {$MONITOR_PASSWORD_HASH}
	}
	reverse_proxy monitor:8080
}