# =============================================================================
# ai-routes.caddy - the blocks to paste into ~/Caddyfile on lin001.
#
# This file is NOT deployed as-is. ~/Caddyfile is a single hand-maintained file
# with many .bak-* snapshots beside it. Append these blocks, then:
#
#   cp ~/Caddyfile ~/Caddyfile.bak-ai-$(date +%Y%m%d)
#   docker exec caddy caddy reload --config /etc/caddy/Caddyfile
#
# `import authelia` is the shared AD + Duo gate. OMITTING IT SILENTLY MAKES THE
# SERVICE PUBLIC. Every block below keeps it - there is no deliberate exception
# anywhere in this stack. (Forgejo omits it only because forward-auth breaks
# git clients; that reason does not apply to anything here.)
#
# DNS is not managed on this host. Each hostname needs an A record ->
# 20.211.144.151 before Caddy can issue a certificate. Ask Dan.
#
# Azure hairpin: LAN hosts cannot reach the VM public IP from inside the VNet.
# For an operator on cicore1 to reach ai.yokogawa.tech by hostname, the DC needs
# a pinpoint record -> 10.0.0.17, the same treatment influx.yokogawa.tech has.
# Raise this early - it is a dependency on someone else and will not surface
# until Phase 7.
#
# Add each block at the phase that needs it, not all at once. A hostname with a
# Caddyfile block and no Authelia rule is a hole.
# =============================================================================

# --- Phase 2 -----------------------------------------------------------------
lf.yokogawa.tech {
  import authelia
  reverse_proxy langfuse:3000
}

# --- Phase 5 -----------------------------------------------------------------
cube.yokogawa.tech {
  import authelia
  reverse_proxy cube:4000
}

# --- Phase 6 -----------------------------------------------------------------
api.yokogawa.tech {
  import authelia
  reverse_proxy ai-api:8000
}

# --- Phase 9 -----------------------------------------------------------------
# Document upload needs two changes to the block above. No new hostname: the
# upload endpoints live under /docs on the existing API.
#
# 1. ai-api must learn WHO is calling. Authelia returns Remote-User,
#    Remote-Name, Remote-Email and Remote-Groups from the forward-auth
#    subrequest; Caddy only passes them upstream if it is told to.
#
#      CHECK ~/Caddyfile's shared `authelia` snippet FIRST. If it already sets
#      copy_headers, this is done and duplicating it is a no-op at best. Do NOT
#      edit the shared snippet to add it - every other service on the host
#      imports it, and this is not the change to make on their behalf.
#
#    If the snippet does not copy them, replace the Phase 6 block with:
#
#      api.yokogawa.tech {
#        forward_auth authelia:9091 {
#          uri /api/verify?rd=https://auth.yokogawa.tech
#          copy_headers Remote-User Remote-Name Remote-Email Remote-Groups
#        }
#        request_body {
#          max_size 50MB          # match MAX_UPLOAD_MB; Caddy refuses larger
#        }
#        reverse_proxy ai-api:8000
#      }
#
#    - matching the shared snippet's own forward_auth arguments, which must be
#    read off the host rather than assumed from this comment.
#
# 2. ai-api trusts those headers only because nothing outside the proxy network
#    can reach it. If anything here ever gains a published port, that trust is
#    gone and the /docs endpoints are open to whoever can reach the port.
#
# The group restriction is NOT expressed here. It goes in the Authelia rule for
# ^/docs/.* (authelia/access-rules.md), and is re-checked in ai-api. A Caddy
# matcher would be a third place to keep in step, and the first to be forgotten.

# --- Phase 7 -----------------------------------------------------------------
ai.yokogawa.tech {
  import authelia
  reverse_proxy ai-web:80
}