Caddyfile

# EPI Gateway — Caddy reverse proxy with automatic HTTPS
#
# Usage:
#   docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
#
# Replace "epi.example.com" with your actual domain.
# Caddy obtains and renews a Let's Encrypt certificate automatically.
#
# For local self-signed HTTPS (no domain), replace the hostname with:
#   localhost
# Caddy will issue a locally-trusted cert via its built-in CA.

epi.example.com {
    # Forward all traffic to the gateway container
    reverse_proxy gateway:8787

    # Compress responses
    encode gzip

    # Security headers
    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains"
        X-Content-Type-Options nosniff
        X-Frame-Options DENY
        Referrer-Policy strict-origin-when-cross-origin
    }

    # Expose Prometheus metrics only to internal scrape (remove block to open)
    @metrics path /metrics
    handle @metrics {
        # Allow only localhost / internal network to scrape metrics.
        # Comment this block out if your Prometheus is external.
        respond "Forbidden" 403
    }

    log {
        output stdout
        format json
    }
}