# Web frontend routing inside the bokf-web container: the login gate
# (bokfweb, 127.0.0.1:7682) and the browser terminal (ttyd, 127.0.0.1:7681).
# Nothing reaches ttyd without the gate's OK.
#
# Plain HTTP on :8790, published on the host's loopback only. TLS for
# https://bokf.makandra.eu is the host's reverse proxy (the NAS Caddy):
#
#     bokf.makandra.eu {
#         tls { dns inwx ... }          # as for the other sites
#         reverse_proxy 127.0.0.1:8790
#     }
{
	auto_https off
	admin off
	servers {
		# the host proxy's X-Forwarded-For names the real client (the
		# gate limits failed logins per client address)
		trusted_proxies static private_ranges
	}
}

:8790 {
	header {
		Strict-Transport-Security "max-age=31536000"
		-Server
	}

	redir / /web/ 302

	# the terminal: only with a live login whose handle is in the URL
	@tty path /web/tty /web/tty/*
	handle @tty {
		forward_auth 127.0.0.1:7682 {
			uri /auth
		}
		reverse_proxy 127.0.0.1:7681
	}

	# login page, login and logout
	handle /web* {
		reverse_proxy 127.0.0.1:7682
	}

	handle {
		respond "not found" 404
	}
}