{
	admin off
	persist_config off
	# Plaintext is rejected below for every host instead of redirected.
	auto_https disable_redirects
	http_port 8786
	https_port 8785
	default_bind 127.0.0.1
	log default {
		exclude http.log.access http.log.error
	}
	servers 127.0.0.1:8785 {
		max_header_size 32KiB
		protocols h1 h2
		strict_sni_host on
		timeouts {
			read_header 15s
			read_body 30s
			write 60s
			idle 15s
		}
		listener_wrappers {
			proxy_protocol {
				timeout 2s
				allow 127.0.0.0/8 ::1/128
				fallback_policy reject
			}
			tls
		}
	}
	servers 127.0.0.1:8786 {
		max_header_size 32KiB
		protocols h1 h2
		strict_sni_host on
		timeouts {
			read_header 15s
			read_body 30s
			write 60s
			idle 15s
		}
		listener_wrappers {
			proxy_protocol {
				timeout 2s
				allow 127.0.0.0/8 ::1/128
				fallback_policy reject
			}
			tls
		}
	}
}

import /etc/caddy/routes.caddy

https://{$PUBLIC_HOST} {$PUBLIC_HTTPS_ALIASES} {
	import delivery_routes
	header Strict-Transport-Security "max-age=31536000"
}

http://127.0.0.1:8788 {
	import delivery_routes
}

http:// {
	respond "Use HTTPS" 400
}

http://127.0.0.1:8789 {
	import creation_routes
}
