# Application-routing Caddy for the long-lived dev environment.
# Listens only on the `edge` Docker network; TLS termination and the
# real `:80`/`:443` listeners belong to the host Caddy in front of us.
#
# `/srv/galaxy-ui` is mounted from the `galaxy-dev-ui-dist` named volume,
# refreshed on every dev-deploy run.

{
    auto_https off
}

:80 {
    @frontend host www.galaxy.lan
    handle @frontend {
        root * /srv/galaxy-ui
        try_files {path} /index.html
        file_server
        encode zstd gzip
    }

    @api host api.galaxy.lan
    handle @api {
        # Connect-Web (authenticated) lives on a separate listener
        # (`GATEWAY_AUTHENTICATED_GRPC_ADDR=:9090`). Anything else —
        # public auth, healthz — is the public REST listener on
        # `:8080`. The split mirrors the Vite dev-server proxy in
        # `ui/frontend/vite.config.ts`.
        @connect path /galaxy.gateway.v1.EdgeGateway/*
        handle @connect {
            # `flush_interval -1` disables Caddy's response buffering on
            # this path so server-streaming Connect-Web responses (the
            # SubscribeEvents push channel) deliver each event to the
            # browser as soon as the gateway flushes it. Without it
            # Caddy buffers the initial `gateway.service_time` frame
            # and Safari's fetch-streaming layer treats the body as
            # idle, cancels within ~2 s, and falls into a tight
            # reconnect loop the user sees as the intermittent
            # "Fetch API cannot load … due to access control checks"
            # console error.
            reverse_proxy galaxy-api:9090 {
                flush_interval -1
            }
        }
        reverse_proxy galaxy-api:8080
    }
}