# Caddy — reverse proxy for PIG.
#
# Serve the app and the API from ONE hostname. Auth sessions live in
# per-origin browser storage, so splitting them across two hostnames makes
# sign-in loop endlessly in a way that looks like a server fault.

primeintellectgrowth.com, www.primeintellectgrowth.com {
	encode zstd gzip

	# The MCP endpoint, when Streamable HTTP is enabled. Same origin as the
	# app so it shares the session and needs no CORS allowance.
	reverse_proxy 127.0.0.1:8920


	# The inline script hash covers the pre-paint theme script in index.html,
	# which sets light/dark before first paint so dark-mode users do not get a
	# white flash. It cannot be an external file without reintroducing that
	# flash, and it cannot use 'unsafe-inline' without defeating the CSP.
	#
	# IMPORTANT: editing that script changes its hash and CSP will silently
	# block it. The browser console says exactly which hash it wants.
	header {
		Strict-Transport-Security "max-age=31536000; includeSubDomains"
		X-Content-Type-Options "nosniff"
		X-Frame-Options "DENY"
		Referrer-Policy "strict-origin-when-cross-origin"
		# The app is entirely first-party except for the auth provider, which
		# it must reach over XHR.
		Content-Security-Policy "default-src 'self'; connect-src 'self' https://*.supabase.co; img-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'sha256-1tTDwCq+TCEyPDSZeYqW5HbmP+unUg8hrgRiZBiH/IU='; frame-ancestors 'none'; base-uri 'self'"
		-Server
	}
}

# Short alias. A redirect rather than a second origin, deliberately — see above.
pig.karti.ai {
	redir https://primeintellectgrowth.com{uri} permanent
}