# deploy/caddy-site.snippet
# Caddy-motsvarigheten till nginx.conf för imagesbyolofsson.se (statisk dist/ från `astro build`,
# build.format "file": /about -> about.html, 404 -> 404.html).
#
# Användning i Caddyfile (Caddy >= 2.7):
#
#   import /etc/caddy/snippets/caddy-site.snippet
#
#   www.imagesbyolofsson.se {
#       import ibo_www_redirect
#   }
#   imagesbyolofsson.se {
#       # Befintliga specialregler (t.ex. handle /download/original* -> Immich-proxyn)
#       # ska ligga FÖRE importen, så att de vinner över try_files/file_server.
#       import ibo_site /srv/imagesbyolofsson/dist
#   }
#
# Argumentet är sökvägen till dist-katalogen på servern (justera till den riktiga).

(ibo_www_redirect) {
	redir https://imagesbyolofsson.se{uri} permanent
}

(ibo_site) {
	root * {args[0]}
	encode zstd gzip

	# --- Säkerhetsheaders ---
	# CSP: tillåter Meta Pixel (laddas först efter samtycke), anonym statistik via sendBeacon
	# till customer.imagesbyolofsson.se och Cloudflares egna skript (/cdn-cgi, ev. Web Analytics).
	# 'unsafe-inline' behövs för samtyckesskriptet och Astros inlinade skript/stilar.
	header {
		Strict-Transport-Security "max-age=31536000"
		X-Content-Type-Options "nosniff"
		X-Frame-Options "SAMEORIGIN"
		Referrer-Policy "strict-origin-when-cross-origin"
		Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=(), usb=()"
		Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://connect.facebook.net https://static.cloudflareinsights.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://www.facebook.com https://*.facebook.com; font-src 'self' data:; connect-src 'self' https://customer.imagesbyolofsson.se https://www.facebook.com https://*.facebook.com https://connect.facebook.net https://cloudflareinsights.com; frame-src https://www.facebook.com; frame-ancestors 'self'; base-uri 'self'; form-action 'self'; object-src 'none'; upgrade-insecure-requests"
		-Server
	}

	# --- Cache-Control (ömsesidigt uteslutande matchers) ---
	@ibo_immutable path /_astro/*
	header @ibo_immutable Cache-Control "public, max-age=31536000, immutable"

	@ibo_media {
		path *.jpg *.jpeg *.png *.webp *.avif *.gif *.svg *.ico *.woff *.woff2 *.ttf *.otf
		not path /_astro/*
	}
	header @ibo_media Cache-Control "public, max-age=2592000"

	@ibo_textfiles path *.xml *.txt
	header @ibo_textfiles Cache-Control "public, max-age=3600"

	@ibo_pages {
		not path /_astro/*
		not path *.jpg *.jpeg *.png *.webp *.avif *.gif *.svg *.ico *.woff *.woff2 *.ttf *.otf *.xml *.txt
	}
	header @ibo_pages Cache-Control "public, max-age=0, must-revalidate"

	# --- 301:or ---
	# Gamla indexerade adresser -> portfolion.
	@ibo_old path /my-people /my-people/ /animales-and-nature /animales-and-nature/ /celebrations-with-family /celebrations-with-family/ /northen-lights /northen-lights/
	redir @ibo_old /portfolio permanent

	# /index.html -> /
	redir /index.html / permanent

	# /about.html -> /about (404-sidan hanteras separat nedan)
	@ibo_htmlext {
		path_regexp ibo_htmlext ^(/.+)\.html$
		not path /404.html
	}
	redir @ibo_htmlext {re.ibo_htmlext.1}{?query} permanent

	# Avslutande snedstreck: /about/ -> /about
	@ibo_trailing path_regexp ibo_trailing ^(/.+)/$
	redir @ibo_trailing {re.ibo_trailing.1}{?query} permanent

	# 404-sidan ska bara synas som svar på okända adresser, inte som egen URL med 200.
	@ibo_404page path /404 /404.html
	error @ibo_404page 404

	# --- Statiska filer ---
	try_files {path} {path}.html
	file_server

	# Riktig 404: 404.html med status 404 (inte startsidan med 200).
	handle_errors {
		@ibo_notfound expression {err.status_code} == 404
		handle @ibo_notfound {
			root * {args[0]}
			rewrite * /404.html
			file_server {
				status 404
			}
		}
	}
}