# example of securing full service
# TODO replace domain and service name and port
service.example.com {
	forward_auth preauth {
		uri {uri}
		copy_headers Remote-User
	}
	reverse_proxy service-container:80
}

# you can choose to only restrict select paths
# or any other Caddy match criteria, if desired
# IE: https://protected.example.com/secure/
protected.example.com {
	# note any request that does not start with "/secure/" is NOT protected
	forward_auth /secure/* preauth {
		uri {uri}
		copy_headers Remote-User
	}
	reverse_proxy protected-service:9000
}

# optionally, if you want to use a subdomain for central preauth
# set SUBDOMAIN_REDIRECT to true
# and AUTH_SUBDOMAIN to match the subdomain you use here
auth.example.com {
	reverse_proxy preauth
}

# --- public rate-limited access (v1.1) ---
# Configure PUBLIC_PATHS env var to specify which paths are public.
# Example: PUBLIC_PATHS=/public/**
# Unauthenticated visitors to public paths are rate-limited separately
# from login attempts. Authenticated users bypass the public rate limiter.
#
# This example protects all of Gitea except /public/** which is
# publicly accessible but rate-limited (e.g., 100 req/min, 500 req/hr).
git.example.com {
	forward_auth preauth {
		uri {uri}
		copy_headers Remote-User
	}
	reverse_proxy gitea:3000
}
# In preauth's .env:
#   PUBLIC_PATHS=/public/**
#   PUBLIC_BURST_COUNT=100
#   PUBLIC_BURST_TIME=60
#   PUBLIC_UPPER_COUNT=500
#   PUBLIC_UPPER_TIME=3600