# Caddy reverse-proxy snippet for Oikos — Phase 6 cutover, updated for the
# client/server split (plans/2026-07-12-wails-desktop-app.md, Phase 0).
# Lives in dtoro/caddy-conf repo; auto-deploys to caddy (LXC 121). THIS COPY
# IS A REFERENCE, NOT DEPLOYED FROM HERE — keep it in sync manually.
#
# The SPA is no longer embedded in the oikos binary; it's built and served
# by its own container (compose/web/Dockerfile, docker-compose.yml's `web`
# service, mac-mini:8091) rather than as static files read off local disk —
# see that service's comment for why. Every API/MCP/agent route now requires
# a bearer token in all cases (api's dev-open bypass was removed) —
# non-browser clients (Wails, curl, a future mobile client) can't complete
# Authentik's browser-session login, so those routes bypass `import
# authentik` the same way the enrollment endpoint always has and rely on
# api's own combinedAuth instead. See the Wails plan's "Plan review"
# section, gap 1.
#
# mac-mini and the LXC subnet are routed, so these target its direct LAN IP
# rather than the mesh (netbird) hostname.

oikos.hubris.network {
    tls {
        dns ionos {env.IONOS_AUTH_API_TOKEN}
    }
    @enroll path /api/v1/clients/enroll /oidc-callback
    handle @enroll {
        reverse_proxy 192.168.178.182:8090
    }
    # Bearer-token clients — api's combinedAuth (internal/httpapi/server.go)
    # is the real gate for all three; Authentik would just reject non-browser
    # callers before they ever get there. /agent/* now goes through api's own
    # (auth'd) proxy mount rather than straight to nomos:8092, so it's
    # covered by the same check as /api/v1/* and /mcp.
    @api path /api/v1/* /mcp /agent/*
    handle @api {
        reverse_proxy 192.168.178.182:8090
    }
    # Everything else: the static SPA shell, served by the `web` container.
    # No sensitive data lives here — real enforcement is the bearer-token
    # check above — Authentik is just a first line of defense against
    # anonymous crawlers finding the bundle.
    handle {
        import authentik
        reverse_proxy 192.168.178.182:8091
    }
}

# Oikos MCP endpoint (agents) — bearer token required (api's combinedAuth),
# no separate gate here.
mcp.hubris.network {
    reverse_proxy 192.168.178.182:8090
}

# Nomos's own gateway (workstation access) — still has NO auth of its own
# (C1, plans/2026-07-11-nomos-agent-code-review.md, still open). Anyone who
# can reach this host can talk to nomos directly, bypassing api entirely.
# Not fixed by the client/server split — tracked separately.
nomos.hubris.network {
    reverse_proxy 192.168.178.182:8092
}