# OpenCE on fiesta.soup-os.net: the web build, served to the players.
#
# HTTPS only, on 443: the certificate and key are the ones from ssls.com
# (/etc/ssl/fiesta, the key readable by the caddy user alone). No listener on
# 80, so the players need the https address; a redirect there would be
# `http://fiesta.soup-os.net { redir https://{host}{uri} }` and another port
# open in the security group.
#
# The page needs to be cross-origin isolated: the game's threads use
# SharedArrayBuffer, which a browser gives only to a page that sends
# Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy. The site's
# own service worker can add them, but sending them here means the first
# visit needs no reload (port/web/README.md, "Hosting").
#
# The site carries no game data: each player imports their own disc image
# into their own browser's storage. Nothing is uploaded.

{
	# the certificate is this one, not one fetched by ACME, and there is no
	# redirect from 80: nothing listens there (Caddy opens 80 for the
	# challenge or a redirect, and needs neither here)
	auto_https disable_redirects
	admin localhost:2019
}

https://fiesta.soup-os.net {
	tls /etc/ssl/fiesta/fullchain.pem /etc/ssl/fiesta/privkey.pem

	root * /srv/fiesta/site
	file_server

	header {
		# cross-origin isolation, for SharedArrayBuffer
		Cross-Origin-Opener-Policy same-origin
		Cross-Origin-Embedder-Policy require-corp
		Cross-Origin-Resource-Policy same-origin
		# the game's own build is offered for each new one (version.json)
		Cache-Control "no-cache"
		-Server
	}

	# WebAssembly.instantiateStreaming refuses anything but this type
	@wasm path *.wasm
	header @wasm Content-Type application/wasm

	encode gzip

	log {
		output file /var/log/caddy/fiesta.log
		level WARN
	}
}
