# Import this file from the existing Caddy configuration only after the
# loopback-only service passes preflight and runtime verification.

(hadox_sign_headers) {
	header {
		-Server
		Link "<https://sign.hadox.org/source/documenso-v2.15.0-hadox-source.tar.gz>; rel=source"
		Strict-Transport-Security "max-age=31536000; includeSubDomains"
		X-Content-Type-Options "nosniff"
		Referrer-Policy "strict-origin-when-cross-origin"
		Permissions-Policy "camera=(), microphone=(), geolocation=()"
	}
}

(hadox_sign_log) {
	log {
		output stdout
		format filter {
			# Signing, invite, verification, and reset bearer tokens appear in paths.
			# Keep method/status/timing, but never persist the URI or referrer.
			request>uri delete
			request>headers>Referer delete
			request>headers>Authorization delete
			request>headers>Cookie delete
			wrap json
		}
	}
}

sign.hadox.org {
	import hadox_sign_headers

	handle_path /source/* {
		root * /srv/hadox/documenso/source
		file_server
	}

	handle {
		request_body {
			max_size 25MB
		}

		reverse_proxy 127.0.0.1:18085 {
			header_up -Forwarded
			header_up -X-Forwarded-Port
			header_up -X-Real-IP
			header_up -X-Original-Forwarded-For
			header_up -X-Original-URL
			header_up -X-Original-Method
			header_up -X-Forwarded-Access-Token
			header_up X-Forwarded-Port 443
			transport http {
				dial_timeout 5s
				response_header_timeout 120s
			}
		}
	}

	import hadox_sign_log
}
