# TLS termination for the FedWiki farm (test stack only).
#
# wiki-security-social (better-auth) issues Secure cookies, which browsers only
# store over HTTPS. Browsers reach farm sites through here on :443; member-console
# keeps talking to fedwiki's plain-HTTP admin API directly (bearer token, no
# cookies), so it bypasses this proxy entirely.
#
# Caddy mints the wildcard cert from its own internal CA (no public ACME). To
# trust it for manual browsing, export the root once and add it to your trust store:
#
#   docker compose cp caddy:/data/caddy/pki/authorities/local/root.crt ./caddy-root.crt
#
# Automated chrome-devtools can instead launch Chrome with --ignore-certificate-errors
# (it still counts as a secure context, so Secure cookies are stored).

{
	# The container trust store is ephemeral; don't try to modify it.
	skip_install_trust
}

# Single-level subdomains (admin.localtest.me, <site>.localtest.me) plus the apex.
*.localtest.me, localtest.me {
	tls internal
	reverse_proxy fedwiki:80
}
