# Caddy route for the Control Service.
#
# APPLIED 2026-10-13 (AUD-78). This file records the live configuration.
#
# DNS:    webrestrict.lab.audasmedia.com.au
# Owner:  the Caddy container on .35 (sam-Ubuntu1), Caddyfile bind-mounted at
#         /Docker/Containers/caddy/Caddyfile (owned by sam:sam).
# Result: https://webrestrict.lab.audasmedia.com.au -> 192.168.20.13:8791
#         Let's Encrypt certificate issued via HTTP-01 on 2026-10-13.
# Backup: /Docker/Containers/caddy/Caddyfile.bak.aud78-<timestamp>

webrestrict.lab.audasmedia.com.au {
	reverse_proxy 192.168.20.13:8791
}

# No basic-auth: the Control Service has its own session login (AGENTS.md §9),
# matching the paperclip.lab and mail.lab vhosts.
#
# .13:8791 is reachable from .35 through the Docker-published port without a
# firewall rule. If that ever stops working, add 8791 to
# networking.firewall.allowedTCPPorts on .13 and rebuild.
#
# To apply this block on another host:
#   ssh sam@192.168.20.35
#   cp /Docker/Containers/caddy/Caddyfile /Docker/Containers/caddy/Caddyfile.bak
#   cat >> /Docker/Containers/caddy/Caddyfile   # append the block above
#   docker exec caddy caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile
#   docker exec caddy caddy reload   --config /etc/caddy/Caddyfile --adapter caddyfile
#   curl -s https://webrestrict.lab.audasmedia.com.au/health