# The live block on cloud-2, kept here so the config is reviewable in the repo.
# Copy of /etc/caddy/Caddyfile's demo section — if you change one, change both.

# Both names serve the same build from the same root. The prerendered HTML
# carries <link rel=canonical> pointing at the primeintellectgrowth name, so
# the second hostname does not split search ranking between two copies.
demo.primeintellectgrowth.com, demo.lumbridgecorp.com {
	# REQUIRED, and its absence is silent. Without it Caddy builds a second
	# server on *:443 that has never heard of this hostname, and public traffic
	# — which NATs to 10.0.0.2 — falls through to an empty 200 behind a
	# perfectly valid certificate. A --resolve check from cloud-2 still passes,
	# so the only way to catch it is to curl the real hostname from elsewhere.
	bind 10.0.0.2
	import secweb
	encode zstd gzip
	root * /var/www/demo.primeintellectgrowth.com

	# The whole point of this site is being found and read, so it says so
	# explicitly. primeintellectgrowth.com itself serves noindex.
	header X-Robots-Tag "index, follow"

	@assets path /assets/*
	header @assets Cache-Control "public, max-age=31536000, immutable"
	@docs not path /assets/*
	header @docs Cache-Control "no-cache"

	# No SPA fallback. Every route is prerendered to its own index.html, so a
	# fallback to the app shell would answer 200 for a typo'd URL and let a
	# crawler index unlimited copies of the homepage.
	try_files {path} {path}/index.html
	file_server

	handle_errors {
		rewrite * /404.html
		file_server
	}
}