# Kvitt Caddyfile (SPEC §10.5.2, D-117). Installed as /opt/kvitt/Caddyfile; cert-sync reloads it through the admin API.
{
	admin 0.0.0.0:2019
	auto_https off
	# Caddy's own error log (for example a 502 when the server is down) carries the request too: same URI filter.
	log default {
		output stderr
		format filter {
			request>uri regexp `^(/i/)[^?]+|([?]).+` `${1}${2}REDACTED`
			wrap json
		}
	}
}

icehack.asuscomm.com:8443 {
	tls /certs/fullchain.pem /certs/privkey.pem
	request_body {
		max_size 6MB
	}
	# Set after the server's response headers (defer), so a header the server also sends appears once.
	header {
		defer
		Content-Security-Policy "default-src 'none'; style-src 'unsafe-inline'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'"
		X-Content-Type-Options nosniff
		X-Frame-Options DENY
		Referrer-Policy no-referrer
	}
	reverse_proxy server:8080
	# Access log: the invite code in /i/<code> and every query string (the inviter's name in ?from=) become
	# REDACTED (SPEC §8.7); the Authorization header is redacted by Caddy's default.
	log {
		output stdout
		format filter {
			request>uri regexp `^(/i/)[^?]+|([?]).+` `${1}${2}REDACTED`
			wrap json
		}
	}
}