wrolpi/etc/raspberrypios/Caddyfile

# Caddy config for WROLPi services (RPi/Debian bare metal).
{
	# No ACME - WROLPi is designed for offline use.
	auto_https disable_redirects
}

:443 {
	tls /etc/ssl/wrolpi/cert.crt /etc/ssl/wrolpi/cert.key

	header Access-Control-Allow-Origin "*"
	header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
	header Access-Control-Allow-Headers "Content-Type, Accept"

	handle /ca.crt {
		root * /media/wrolpi/config/ssl
		header Content-Type "application/x-x509-ca-cert"
		header Content-Disposition "attachment; filename=\"wrolpi-ca.crt\""
		file_server
	}

	handle /favicon.ico {
		root * /opt/wrolpi
		rewrite * /icon.ico
		file_server
	}

	handle /apple-touch-icon.png {
		root * /opt/wrolpi
		rewrite * /icon.png
		file_server
	}

	# WebSocket for React dev server.
	handle /ws {
		reverse_proxy 0.0.0.0:3000
	}

	# Controller - system management API and UI.
	handle_path /controller/* {
		reverse_proxy 0.0.0.0:80
	}
	handle /controller {
		redir * /controller/ 301
	}

	# Main API.
	handle /api/* {
		reverse_proxy 0.0.0.0:8081
	}


	# WROLPi blobs (planet overview map, fonts, etc.)
	handle_path /blobs/* {
		root * /opt/wrolpi-blobs
		file_server
	}

	# Map static assets (fonts, sprites) for embedded MapLibre viewer.
	handle_path /map-assets/* {
		root * /opt/wrolpi/modules/map/static
		file_server
	}

	# Custom MIME types not in Caddy's defaults.
	@yaml path *.yaml *.yml
	header @yaml Content-Type "text/yaml"

	@epub path *.epub
	header @epub Content-Type "application/epub+zip"

	@mobi path *.mobi
	header @mobi Content-Type "application/x-mobipocket-ebook"

	# Static media files with directory browsing.
	handle_path /media/* {
		root * /media/wrolpi
		header Content-Disposition "inline"
		file_server browse
	}
	handle /media {
		redir * /media/ 301
	}

	# Downloads with Content-Disposition header.
	handle_path /download/* {
		root * /media/wrolpi
		header Content-Disposition "attachment"
		file_server browse
	}
	handle /download {
		redir * /download/ 301
	}

	# React app with fallback to Controller.
	handle {
		reverse_proxy 0.0.0.0:3000
	}

	handle_errors 502 503 504 {
		redir * "http://{host}/?fallback=true" 302
	}
}

# Kiwix HTTPS proxy.
:8085 {
	tls /etc/ssl/wrolpi/cert.crt /etc/ssl/wrolpi/cert.key
	header ?Access-Control-Allow-Origin "*"
	header ?Access-Control-Allow-Methods "GET, OPTIONS"
	reverse_proxy 0.0.0.0:9085
}

# Help HTTPS proxy.
:8086 {
	tls /etc/ssl/wrolpi/cert.crt /etc/ssl/wrolpi/cert.key
	header ?Access-Control-Allow-Origin "*"
	header ?Access-Control-Allow-Methods "GET, OPTIONS"
	reverse_proxy 0.0.0.0:9086
}

# Map viewer - serves MapLibre static assets and PMTiles data via Caddy.
:8084 {
	tls /etc/ssl/wrolpi/cert.crt /etc/ssl/wrolpi/cert.key
	header ?Access-Control-Allow-Origin "*"
	header ?Access-Control-Allow-Methods "GET, HEAD, OPTIONS"
	header ?Access-Control-Expose-Headers "Content-Range, Content-Length"

	# PMTiles file list from WROLPi API.
	handle /api/map/* {
		reverse_proxy 0.0.0.0:8081
	}

	# WROLPi blobs (planet overview map).
	handle_path /blobs/* {
		root * /opt/wrolpi-blobs
		file_server
	}

	# PMTiles data files from media directory (Range Requests supported by default).
	handle_path /data/* {
		root * /media/wrolpi/map
		file_server
	}

	# MapLibre static assets (HTML, JS, CSS, fonts, sprites).
	handle {
		root * /opt/wrolpi/modules/map/static
		file_server
	}
}