# Caddy reverse-proxy snippet for Oikos — Phase 6 cutover
# Lives in dtoro/caddy-conf repo; auto-deploys to caddy (LXC 121).
# Replaces the old MCP server on apps/105 with the Docker stack on mac-mini.

# Oikos REST API (operator) — enrollment endpoint bypasses Authentik
oikos.hubris.network {
    tls {
        dns ionos {env.IONOS_AUTH_API_TOKEN}
    }
    @enroll path /api/v1/clients/enroll
    handle @enroll {
        reverse_proxy <mac-mini-mesh-ip>:8090
    }
    # Nomos agent, same-origin for the control-room UI (EventSource/fetch can't
    # set cross-origin auth headers). Authentik gates it; handle_path strips
    # the /agent prefix so /agent/chat -> nomos /chat.
    handle_path /agent/* {
        import authentik
        reverse_proxy <mac-mini-mesh-ip>:8092
    }
    handle {
        import authentik
        reverse_proxy <mac-mini-mesh-ip>:8090
    }
}

# Oikos MCP endpoint (agents) — no auth required
mcp.hubris.network {
    reverse_proxy <mac-mini-mesh-ip>:8090
}

# Nomos gateway (workstation access) — formerly hermes.hubris.network
nomos.hubris.network {
    reverse_proxy <mac-mini-mesh-ip>:8092
}