Caddyfile

Rama main · réplica de lectura del repositorio original.

# Email verification and password reset tokens and MCP API keys travel in the query string,
# invitation tokens in the path; the logs would otherwise be the plaintext store of every one of
# those secrets. Tokens are 43 base64url characters, so the length floor leaves fixed segments
# such as /invitations/accept readable.
(redact_secrets) {
	format filter {
		wrap json
		fields {
			request>uri regexp "(/(?:team-)?invite/|/api/v1/(?:team-)?invitations/|[?&]token=|[?&]apiKey=)[A-Za-z0-9_%-]{32,}" "$1[redacted]"
		}
	}
}

{
	# Access logs are filtered in the site block; this covers the error log, which records the
	# full request whenever an upstream is unreachable, such as while the API restarts.
	log default {
		output stdout
		import redact_secrets
	}
}

# Only useful when a www record points at this host; without one Caddy retries certificate
# issuance for the name in the background, which is noisy in the logs but harmless.
www.{$REMENTUM_DOMAIN:localhost} {
	redir https://{$REMENTUM_DOMAIN:localhost}{uri} permanent
}

{$REMENTUM_DOMAIN:localhost} {
	encode zstd gzip
	# The API accepts archives of up to 100 MB plus multipart overhead; nothing larger is
	# legitimate, so it is refused at the edge before any service buffers it.
	request_body {
		max_size 110MB
	}
	log {
		output stdout
		import redact_secrets
	}

	@backend path /api/* /mcp/* /.well-known/* /oauth/* /healthz /readyz /metrics
	handle @backend {
		reverse_proxy api:8787
	}

	# The documentation ships as its own image so every instance serves the guide that matches
	# the version it runs. The docs server expects the unstripped /docs path.
	@docs path /docs /docs/*
	handle @docs {
		reverse_proxy docs:8080
	}

	# The guide lived at the site root before it moved under /docs; installed plugins and older
	# web builds still link to these pages.
	@legacy_docs path_regexp ^/(installation|configuration|operations|security|integrations|brand|development|rementum-flow\.html)/?$
	redir @legacy_docs /docs{uri} permanent

	handle {
		reverse_proxy web:3000
	}

	header {
		Strict-Transport-Security "max-age=31536000; includeSubDomains"
		X-Content-Type-Options nosniff
		X-Frame-Options DENY
		Referrer-Policy strict-origin-when-cross-origin
		Permissions-Policy "camera=(), geolocation=(), microphone=()"
		-Server
	}
}