# =============================================================================
# ai-routes.caddy - the blocks to paste into ~/Caddyfile on lin001.
#
# This file is NOT deployed as-is. ~/Caddyfile is a single hand-maintained file
# with many .bak-* snapshots beside it. Append these blocks, then:
#
#   cp ~/Caddyfile ~/Caddyfile.bak-ai-$(date +%Y%m%d)
#   docker exec caddy caddy reload --config /etc/caddy/Caddyfile
#
# `import authelia` is the shared AD + Duo gate. OMITTING IT SILENTLY MAKES THE
# SERVICE PUBLIC. Every block below keeps it - there is no deliberate exception
# anywhere in this stack. (Forgejo omits it only because forward-auth breaks
# git clients; that reason does not apply to anything here.)
#
# DNS is not managed on this host. Each hostname needs an A record ->
# 20.211.144.151 before Caddy can issue a certificate. Ask Dan.
#
# Azure hairpin: LAN hosts cannot reach the VM public IP from inside the VNet.
# For an operator on cicore1 to reach ai.yokogawa.tech by hostname, the DC needs
# a pinpoint record -> 10.0.0.17, the same treatment influx.yokogawa.tech has.
# Raise this early - it is a dependency on someone else and will not surface
# until Phase 7.
#
# Add each block at the phase that needs it, not all at once. A hostname with a
# Caddyfile block and no Authelia rule is a hole.
# =============================================================================

# --- Phase 2 -----------------------------------------------------------------
lf.yokogawa.tech {
  import authelia
  reverse_proxy langfuse:3000
}

# --- Phase 5 -----------------------------------------------------------------
cube.yokogawa.tech {
  import authelia
  reverse_proxy cube:4000
}

# --- Phase 6 -----------------------------------------------------------------
api.yokogawa.tech {
  import authelia
  reverse_proxy ai-api:8000
}

# --- Phase 7 -----------------------------------------------------------------
ai.yokogawa.tech {
  import authelia
  reverse_proxy ai-web:80
}