# The console, served on the WireGuard hub address.
#
# Runs inside the provisioning container's network namespace, so it listens on
# 10.66.0.1 — the tunnel address itself. A VPN client therefore needs no route
# beyond the management subnet it already has, and the request arrives at the
# application with its real 10.66.0.x source, which is what the console's own
# IP allowlist checks.
#
# The certificate is the one the public Caddy already obtains and renews for
# this hostname. A certificate is bound to the NAME, not to the address that
# serves it, so the same file is valid here. Shared read-only rather than
# duplicated: a second ACME client would be a second thing to renew, and a
# private address cannot satisfy an HTTP challenge in any case.
{
	admin off
	auto_https off
}

https://{$VPN_INTERNAL_HOST}:443 {
	bind {$VPN_HUB_ADDRESS}
	tls {$VPN_CERT_PATH} {$VPN_KEY_PATH}

	# To the application directly. Resolvable because this container shares the
	# provisioning container's namespace, which is on the compose network.
	reverse_proxy app:80 {
		header_up X-Forwarded-For {remote_host}
		header_up X-Forwarded-Proto https
		header_up Host {host}
	}
}