# Replace authority.example.com with your chosen DNS name before starting Caddy.
# Caddy terminates TLS; both application processes stay loopback-only.
authority.example.com {
  encode zstd gzip
  header {
    Strict-Transport-Security "max-age=31536000"
    X-Content-Type-Options "nosniff"
    Referrer-Policy "strict-origin-when-cross-origin"
  }
  @authorityApi path /v1/* /oauth/* /.well-known/* /mcp /healthz
  handle @authorityApi {
    reverse_proxy 127.0.0.1:4641
  }
  handle {
    reverse_proxy 127.0.0.1:4640
  }
}
