# ABIC_E-Learning / E-Learning-SaaS — reverse proxy config
#
# Serves the same Laravel app under three kinds of host, most-specific wins:
#   1. *.ibi-institutes.com  — every company's handed-out subdomain, one
#      wildcard certificate covering all of them (needs DNS-01, see below).
#   2. ibi-institutes.com    — the root domain: today the existing app,
#      later also the SaaS control panel (Phase 2).
#   3. everything else on :443 — a company's own custom domain. Caddy asks
#      the app (TenantDomainAskController) before ever requesting a
#      certificate for a hostname it doesn't already recognize as a
#      verified custom domain.
#
# Swap ibi-institutes.com below for whatever domain you actually deploy
# under — kept as the current live domain from .env rather than guessing
# at a future rename.

{
	email you@ibi-institutes.com

	on_demand_tls {
		ask      http://127.0.0.1:2015/internal/tls/ask
		interval 2m
		burst    5
	}
}

# Shared site config, imported by every host block below so the app is
# served identically no matter which domain the request arrived on — the
# tenant resolver middleware inside Laravel is what actually differentiates
# one company's request from another's, not this proxy layer.
(app) {
	root * /var/www/abic-e-learning/public
	encode gzip
	php_fastcgi unix//run/php/php8.2-fpm.sock
	file_server
	header {
		Strict-Transport-Security "max-age=31536000; includeSubDomains"
		X-Content-Type-Options "nosniff"
		X-Frame-Options "SAMEORIGIN"
	}
}

# Plain-HTTP, loopback-only. This is how the on_demand_tls "ask" check above
# reaches the app before a certificate exists yet for a brand-new custom
# domain — never bound to a public interface.
127.0.0.1:2015 {
	import app
}

*.ibi-institutes.com {
	tls {
		# Wildcard certs can only be issued via a DNS-01 challenge, which
		# means Caddy needs to be built with a DNS provider plugin (xcaddy)
		# and given API credentials for whichever registrar/DNS host you
		# use. Cloudflare shown as the common case — swap this block and
		# CLOUDFLARE_API_TOKEN for your actual provider if different.
		dns cloudflare {env.CLOUDFLARE_API_TOKEN}
	}
	import app
}

ibi-institutes.com {
	import app
}

:443 {
	tls {
		on_demand
	}
	import app
}
