# Caddy — reverse proxy for PIG.
#
# Serve the app and the API from ONE hostname. Auth sessions live in
# per-origin browser storage, so splitting them across two hostnames makes
# sign-in loop endlessly in a way that looks like a server fault.

primeintellectgrowth.com, www.primeintellectgrowth.com {
	encode zstd gzip

	# The MCP endpoint, when Streamable HTTP is enabled. Same origin as the
	# app so it shares the session and needs no CORS allowance.
	reverse_proxy 127.0.0.1:8920

	header {
		Strict-Transport-Security "max-age=31536000; includeSubDomains"
		X-Content-Type-Options "nosniff"
		X-Frame-Options "DENY"
		Referrer-Policy "strict-origin-when-cross-origin"
		# The app is entirely first-party except for the auth provider, which
		# it must reach over XHR.
		Content-Security-Policy "default-src 'self'; connect-src 'self' https://*.supabase.co; img-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self'; frame-ancestors 'none'; base-uri 'self'"
		-Server
	}
}

# Short alias. A redirect rather than a second origin, deliberately — see above.
pig.karti.ai {
	redir https://primeintellectgrowth.com{uri} permanent
}