{
	on_demand_tls {
        ask {$PRIVATE_BACKEND_URL:localhost:8000}/api/builder/domains/ask-public-domain-exists/
    }

    # Caddy's 16 KiB default rejects API URLs the backend accepts (~64 KiB); the rest is room for other headers.
    servers {
        max_header_size 128KiB
    }

    {$BASEROW_CADDY_GLOBAL_CONF}
}

(baserow_media_files) {
    handle_path /media/* {
        @downloads {
            query dl=*
        }
        header @downloads Content-Disposition "attachment; filename={query.dl}"
        header X-Content-Type-Options "nosniff"
        header Content-Security-Policy "sandbox; default-src 'none'; script-src 'none'; object-src 'none'; base-uri 'none'"

        # Allow to call head from public url to get size
        header {
            Access-Control-Allow-Origin {$BASEROW_PUBLIC_URL:http://localhost}
            Access-Control-Allow-Methods "GET, HEAD, OPTIONS"
            Access-Control-Allow-Headers "*"
            Access-Control-Expose-Headers "Content-Length, Content-Type"
        }

        file_server {
            root {$MEDIA_ROOT:/baserow/media/}
        }
    }
}

{$BASEROW_CADDY_ADDRESSES} {
    tls {
        on_demand
    }

    @is_baserow_tool {
        expression `
            "{$BASEROW_PUBLIC_URL}".contains({http.request.host}) ||
            "{$BASEROW_EXTRA_PUBLIC_URLS}".split(",")
                .filter(u, u != "" && u.contains({http.request.host}))
                .size() > 0
        `
    }

    @is_baserow_media {
        path /media/*
        expression `
            "{$MEDIA_URL:}".startsWith("http://" + {http.request.host} + "/") ||
            "{$MEDIA_URL:}".startsWith("https://" + {http.request.host} + "/") ||
            "{$MEDIA_URL:}".startsWith("http://" + {http.request.host} + ":") ||
            "{$MEDIA_URL:}".startsWith("https://" + {http.request.host} + ":")
        `
    }

    handle @is_baserow_media {
        import baserow_media_files
    }

    handle @is_baserow_tool {
        @backend_routes path /api/* /ws/* /mcp /mcp/* /oauth/* /.well-known/oauth-authorization-server* /.well-known/oauth-protected-resource* /.well-known/openai-apps-challenge /assistant/* {$BASEROW_CADDY_BACKEND_EXTRA_ROUTES:}
        handle @backend_routes {
            reverse_proxy {$PRIVATE_BACKEND_URL:localhost:8000}
        }

        import baserow_media_files

        handle_path /static/* {
            file_server {
                root {$STATIC_ROOT:/baserow/static/}
            }
        }
    }

    reverse_proxy {$PRIVATE_WEB_FRONTEND_URL:localhost:3000}
}
