# Add this site block to the existing Caddy 2.8 Caddyfile (or an already-imported
# site-fragment directory). This does not define a second listener or proxy.
# Replace BASIC_AUTH_HASH with interactive `caddy hash-password` output.
# Basic Auth is the supported access gate; do not add Authelia without confirming
# the existing proxy's auth policy and trusted identity headers.
random.ochenstarik.ru {
    tls {
        issuer acme {
            disable_tlsalpn_challenge
        }
    }
    basic_auth {
        owner BASIC_AUTH_HASH
    }
    # Caddy 2.8 supports this body limit. Keep it ahead of the upstream.
    request_body {
        max_size 1MB
    }
    # No access log: OAuth callback query values are sensitive.
    reverse_proxy 10.77.0.3:3100 {
        header_up Host random.ochenstarik.ru
        header_up X-Forwarded-Host random.ochenstarik.ru
        header_up X-Forwarded-Proto https
        # Replace caller-supplied forwarding metadata; Caddy's peer identity
        # depends on the confirmed HAProxy-to-Caddy path.
        header_up X-Forwarded-For {remote_host}
        header_up -X-Real-IP
        header_up -Forwarded
        header_up -CF-Connecting-IP
        header_up -Authorization
        transport http {
            dial_timeout 10s
            response_header_timeout 120s
        }
    }
}