{
	admin unix//run/caddy-admin.sock
	auto_https disable_redirects
	skip_install_trust
}

(admin_security) {
	header {
		Cache-Control "no-store"
		Pragma "no-cache"
		Referrer-Policy "same-origin"
		Content-Security-Policy "default-src 'none'; style-src 'self'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'"
		X-Content-Type-Options "nosniff"
	}
}

(admin_gate) {
	import {$TRUF_ADMIN_DENYLIST_FILE:/etc/caddy/denylist/admin-denylist.caddy}
	basic_auth bcrypt "truf-admin" {
		{$TRUF_ADMIN_USER} {$TRUF_ADMIN_PASSWORD_HASH}
	}
}

{$TRUF_EDGE_HOST} {
	import {$TRUF_EDGE_TLS_INCLUDE:/etc/caddy/tls/automatic.caddy}
	import admin_security
	header Strict-Transport-Security "max-age=63072000; includeSubDomains"

	log routine_access {
		output discard
	}

	log admin_auth_failures {
		no_hostname
		output file {$TRUF_ADMIN_AUTH_LOG_FILE:/var/log/caddy/admin-auth-failures.json} {
			roll_size 8MiB
			roll_keep 10
			roll_keep_for 240h
		}
		format filter {
			request delete
			bytes_read delete
			user_id delete
			duration delete
			size delete
			resp_headers delete
			wrap json
		}
	}

	@worker path /api/v1/worker/*
	handle @worker {
		reverse_proxy 127.0.0.1:8766 {
			header_up -X-Truf-Admin-Edge
			header_up -X-Truf-Admin-Operator
			header_up -Forwarded
			header_up -X-Real-IP
		}
	}

	@admin_root path /{$TRUF_ADMIN_PREFIX}
	handle @admin_root {
		route {
			import admin_security
			import admin_gate
			redir * /{$TRUF_ADMIN_PREFIX}/ 308
		}
	}

	@admin path /{$TRUF_ADMIN_PREFIX}/*
	handle @admin {
		route {
			import admin_security
			request_header -X-Truf-Admin-Edge
			request_header -X-Truf-Admin-Operator
			import admin_gate
			uri strip_prefix /{$TRUF_ADMIN_PREFIX}
			uri path_regexp ^ /admin-internal
			reverse_proxy 127.0.0.1:8766 {
				header_up -Authorization
				header_up X-Truf-Admin-Edge {$TRUF_ADMIN_EDGE_MARKER}
				header_up X-Truf-Admin-Operator {http.auth.user.id}
				header_up -Forwarded
				header_up -X-Real-IP
				header_down -Strict-Transport-Security
			}
		}
	}

	handle {
		respond "" 404
	}

	handle_errors {
		@bad_admin_credentials {
			path /{$TRUF_ADMIN_PREFIX} /{$TRUF_ADMIN_PREFIX}/*
			header Authorization *
			expression {err.status_code} == 401
		}
		handle @bad_admin_credentials {
			route {
				import admin_security
				log_name admin_auth_failures
				log_append event admin_auth_failure
				log_append remote_ip {http.request.remote.host}
				header WWW-Authenticate "Basic realm=\"truf-admin\""
				respond "" 401
			}
		}

		@admin_unauthorized {
			path /{$TRUF_ADMIN_PREFIX} /{$TRUF_ADMIN_PREFIX}/*
			expression {err.status_code} == 401
		}
		handle @admin_unauthorized {
			route {
				import admin_security
				header WWW-Authenticate "Basic realm=\"truf-admin\""
				respond "" 401
			}
		}

		@admin_error path /{$TRUF_ADMIN_PREFIX} /{$TRUF_ADMIN_PREFIX}/*
		handle @admin_error {
			import admin_security
			respond "" {err.status_code}
		}

		handle {
			respond "" {err.status_code}
		}
	}
}
