# Caddy reverse-proxy snippet for Oikos — Phase 6 cutover
# Lives in dtoro/caddy-conf repo; auto-deploys to caddy (LXC 121).
# Replaces the old MCP server on apps/105 with the Docker stack on mac-mini.

# Oikos REST API (operator) — enrollment endpoint bypasses Authentik
oikos.hubris.network {
    tls {
        dns ionos {env.IONOS_AUTH_API_TOKEN}
    }
    @enroll path /api/v1/clients/enroll
    handle @enroll {
        reverse_proxy <mac-mini-mesh-ip>:8090
    }
    handle {
        import authentik
        reverse_proxy <mac-mini-mesh-ip>:8090
    }
}

# Oikos MCP endpoint (Hermes agents) — no auth required
mcp.hubris.network {
    reverse_proxy <mac-mini-mesh-ip>:8090
}

# Hermes gateway (workstation access)
hermes.hubris.network {
    reverse_proxy <mac-mini-mesh-ip>:8092
}