# Caddy reverse-proxy snippet for Oikos — Phase 6 cutover, updated for the
# client/server split (plans/2026-07-12-wails-desktop-app.md, Phase 0).
# Lives in dtoro/caddy-conf repo; auto-deploys to caddy (LXC 121). THIS COPY
# IS A REFERENCE, NOT DEPLOYED FROM HERE — keep it in sync manually.
#
# The SPA lives in its own repo (dtoro/oikos-web) and deploys as its own
# compose project publishing mac-mini:8091 — see the docker-compose.yml
# comment. Every API/MCP route requires
# a bearer token in all cases (api's dev-open bypass was removed) —
# non-browser clients (Wails, curl, a future mobile client) can't complete
# Authentik's browser-session login, so those routes bypass `import
# authentik` the same way the enrollment endpoint always has and rely on
# api's own combinedAuth instead. See the Wails plan's "Plan review"
# section, gap 1.
#
# mac-mini and the LXC subnet are routed, so these target its direct LAN IP
# rather than the mesh (netbird) hostname.

oikos.hubris.network {
    tls {
        dns ionos {env.IONOS_AUTH_API_TOKEN}
    }
    @enroll path /api/v1/clients/enroll /oidc-callback
    handle @enroll {
        reverse_proxy 192.168.178.182:8090
    }
    # Bearer-token clients — api's combinedAuth (internal/httpapi/server.go)
    # is the real gate; Authentik would just reject non-browser callers
    # before they ever get there, so /api/v1/* and /mcp bypass `import
    # authentik` and rely on api's own combinedAuth.
    @api path /api/v1/* /mcp
    handle @api {
        reverse_proxy 192.168.178.182:8090
    }
    # Everything else: the static SPA shell, served by the `web` container.
    # No sensitive data lives here — real enforcement is the bearer-token
    # check above — Authentik is just a first line of defense against
    # anonymous crawlers finding the bundle.
    handle {
        import authentik
        reverse_proxy 192.168.178.182:8091
    }
}

# Oikos MCP endpoint (agents) — bearer token required (api's combinedAuth),
# no separate gate here.
mcp.hubris.network {
    reverse_proxy 192.168.178.182:8090
}

# nomos.hubris.network (the retired nomos gateway, :8092) was removed with
# the nomos decommission — plans/2026-08-16-dsh-as-agent-replace-nomos.md
# section 5. The agent runtime is dsh (external MCP client, no inbound
# gateway). Remember to mirror this removal in dtoro/caddy-conf.