{
    # use pinned CA from ./localinfra/certs
    pki {
        ca local {
            name "Tangled Dev"
            root_cn "Tangled Dev Root"
            root {
                format pem_file
                cert /etc/caddy/certs/root.crt
                key /etc/caddy/certs/root.key
            }
        }
    }
}

# permissive CORS for the vhosts web/ hits cross-origin from the browser, for the ones
# that serve no CORS headers of their own. prod puts the same header set at the edge in
# front of these services, so localinfra matches it here rather than in each service.
# import it only where the upstream is silent, since duplicate headers fail the check.
(cors) {
    @cors_preflight method OPTIONS
    handle @cors_preflight {
        header Access-Control-Allow-Origin "*"
        header Access-Control-Allow-Methods "GET, POST, OPTIONS"
        header Access-Control-Allow-Headers "Content-Type, authorization, atproto-proxy"
        header Access-Control-Max-Age "86400"
        respond 204
    }
    handle {
        header Access-Control-Allow-Origin "*"
        header Access-Control-Allow-Methods "GET, POST, OPTIONS"
        header Access-Control-Allow-Headers "Content-Type, authorization, atproto-proxy"
        reverse_proxy {args[0]}
    }
}

# did-method-plc
plc.tngl.boltless.dev {
    tls internal
    reverse_proxy plc:8080
}

# pds
*.pds.tngl.boltless.dev, pds.tngl.boltless.dev {
    tls internal
    reverse_proxy pds:3000
}

# tranquil-pds (separate from the reference pds above)
*.tranquil.tngl.boltless.dev, tranquil.tngl.boltless.dev {
    tls internal
    reverse_proxy tranquil:3000
}

# hydrant: /subscribe is its jetstream-compatible feed (appview, spindle, deliberi)
hydrant.tngl.boltless.dev {
    tls internal
    reverse_proxy hydrant:3000
}

# knot2 answers preflight itself (knot2/crates/knot-edge/src/cors.rs), so this block
# doesn't import cors: a browser rejects a response with two Access-Control-Allow-Origin
# values, and web/ posts sh.tangled.git.keepCommit
# straight from the browser to the knot serving the repo.
# knot2-alt is the same knot under a second authority, so a local import exercises the
# remote fetch path instead of the same-authority one
knot2.tngl.boltless.dev, knot2-alt.tngl.boltless.dev {
    tls internal
    reverse_proxy knot2:5555
}

# spindle
http://spindle.tngl.boltless.dev {
    import cors spindle:6555
}

spindle.tngl.boltless.dev {
    tls internal
    import cors spindle:6555
}

# knotmirror
mirror.tngl.boltless.dev {
    tls internal
    import cors knotmirror:7000
}

gitmirror.tngl.boltless.dev {
    tls internal
    reverse_proxy gitmirror:9001
}

# zoekt (internal service)
zoekt.tngl.boltless.dev {
    tls internal

    # TODO: replace this with -indexserver_proxy flag
    handle_path /indexserver/* {
        reverse_proxy zoekt-tngl-indexserver:6060
    }

    handle {
        reverse_proxy zoekt-webserver:6070
    }
}

# appview
tngl.boltless.dev {
    tls internal
    reverse_proxy appview:3000
}

# web (sveltekit dev server). vite's allowedHosts must list this host too, which
# the web service does via VITE_ALLOWED_HOSTS.
web.tngl.boltless.dev {
    tls internal
    reverse_proxy web:5174
}

# pdsls
pdsls.tngl.boltless.dev {
    tls internal
    reverse_proxy pdsls:80
}

# camo and avatar
camo.tngl.boltless.dev {
    tls internal
    reverse_proxy camo:8787
}

avatar.tngl.boltless.dev {
    tls internal
    reverse_proxy avatar:8787
}
# deliberi — sets its own CORS headers, no cors import
deliberi.tngl.boltless.dev {
    tls internal
    reverse_proxy deliberi:6565
}


# pocket - private data store
pocket.tngl.boltless.dev {
    tls internal
    reverse_proxy pocket:3000
}

# migrator
migrator.tngl.boltless.dev {
    tls internal
    reverse_proxy migrator:6767
}

# github stub
github.tngl.boltless.dev, api.github.tngl.boltless.dev {
    tls internal
    reverse_proxy github-stub:8000
}
# bobbin (read appview / xrpc)
bobbin.tngl.boltless.dev {
    tls internal
    import cors bobbin:8090
}

# bobbin over plain http on :8090, for local web/ dev
:8090 {
    import cors bobbin:8090
}

# Delegate provisioning sidecar
delegates.tngl.boltless.dev {
    tls internal
    import cors tranquil-gate:3100
}