# Caddy template for wakey-control-plane with Cloudflare Access.
#
# Security model:
# - Public endpoints for agents: health, enrollment, control WS, and scoped terminal relay WS
# - Private admin surface: root, /ui/* and /api/v1/control/* (verified Access JWT)
# Configure CC's [access] section and loopback bind before enabling this template.
# Never expose /internal/auth/verify through this virtual host.
#
# Replace wakey.ldlda.com and the loopback upstream port for your deployment.

wakey.ldlda.com {
    encode zstd gzip

    # Public agent-facing endpoints.
    @public path /healthz /api/v1/agents/enroll /api/v1/agent/ws /api/v1/agent/terminals/*
    handle @public {
        reverse_proxy 127.0.0.1:6767
    }

    # Applies to HTTP requests and operator WebSocket upgrades, not WS frames.
    @admin path / /ui* /api/v1/control/*

    handle @admin {
        forward_auth 127.0.0.1:6767 {
            uri /internal/auth/verify
        }
        reverse_proxy 127.0.0.1:6767
    }

    # Deny unknown paths by default.
    respond "not found" 404
}