{
    auto_https disable_redirects
    admin off
}

:80 {
    @music_health {
        host musicserver.internal.invalid
        path /health /health/db
    }
    handle @music_health {
        reverse_proxy 10.71.100.83:18080
    }
    @reports {
        host reports.secret-studio.ru reports001.secret-studio.ru
    }
    handle @reports {
        redir https://{host}{uri} 308
    }
    @access {
        host access.secret-studio.ru
    }
    handle @access {
        redir https://access.secret-studio.ru{uri} 308
    }

    @admin_http {
        host admin.secret-studio.ru
        remote_ip 10.250.100.0/24 10.250.101.0/24
    }
    handle @admin_http {
        redir https://admin.secret-studio.ru{uri} 308
    }

    handle {
        respond "not found" 404
    }
}

https://reports.secret-studio.ru {
    log {
        output stderr
        format json
    }

    @crawl_root path /
    handle @crawl_root {
        header Cache-Control "no-cache, max-age=0, must-revalidate"
        header X-Robots-Tag "index, follow"
        root * /srv/wg-paid/web-meta
        rewrite * /index.html
        file_server
    }

    @robots path /robots.txt
    handle @robots {
        header Cache-Control "no-cache, max-age=0, must-revalidate"
        root * /srv/wg-paid/web-meta
        file_server
    }

    @sitemap path /sitemap.xml
    handle @sitemap {
        header Cache-Control "no-cache, max-age=0, must-revalidate"
        root * /srv/wg-paid/web-meta
        rewrite * /sitemap-reports.xml
        file_server
    }

    handle {
        @latest path /latest /latest/*
        header @latest Cache-Control "no-cache, max-age=0, must-revalidate"
        @old path /old /old/*
        header @old Cache-Control "public, max-age=31536000, immutable"
        header X-Robots-Tag "index, follow"
        root * /srv/wg-paid/reports
        file_server
    }
}

https://reports001.secret-studio.ru {
    log {
        output stderr
        format json
    }

    @crawl_root path /
    handle @crawl_root {
        header Cache-Control "no-cache, max-age=0, must-revalidate"
        header X-Robots-Tag "index, follow"
        root * /srv/wg-paid/web-meta
        rewrite * /index.html
        file_server
    }

    @robots path /robots.txt
    handle @robots {
        header Cache-Control "no-cache, max-age=0, must-revalidate"
        root * /srv/wg-paid/web-meta
        file_server
    }

    @sitemap path /sitemap.xml
    handle @sitemap {
        header Cache-Control "no-cache, max-age=0, must-revalidate"
        root * /srv/wg-paid/web-meta
        rewrite * /sitemap-reports001.xml
        file_server
    }

    handle {
        @latest path /latest /latest/*
        header @latest Cache-Control "no-cache, max-age=0, must-revalidate"
        @old path /old /old/*
        header @old Cache-Control "public, max-age=31536000, immutable"
        header X-Robots-Tag "index, follow"
        root * /srv/wg-paid/reports
        file_server
    }
}

https://access.secret-studio.ru {
    header {
        Cache-Control "no-store, max-age=0"
        Pragma "no-cache"
        Referrer-Policy "no-referrer"
        X-Content-Type-Options "nosniff"
        X-Frame-Options "DENY"
        Content-Security-Policy "default-src 'none'; script-src 'self'; style-src 'self'; connect-src 'self'; img-src 'self' blob:; base-uri 'none'; form-action 'self'; frame-ancestors 'none'"
    }

    @health path /health
    handle @health {
        respond "access-ok" 200
    }

    @root path /
    handle @root {
        root * /srv/wg-paid/access-web
        rewrite * /index.html
        file_server
    }

    @login path /login /login/
    handle @login {
        root * /srv/wg-paid/access-web
        rewrite * /index.html
        file_server
    }

    @invite path /invite /invite/
    handle @invite {
        root * /srv/wg-paid/access-web
        rewrite * /index.html
        file_server
    }

    @account path /account /account/
    handle @account {
        root * /srv/wg-paid/access-web
        rewrite * /index.html
        file_server
    }

    @magic path /auth/magic /auth/magic/
    handle @magic {
        root * /srv/wg-paid/access-web
        rewrite * /index.html
        file_server
    }

    @assets path /assets/*
    handle @assets {
        root * /srv/wg-paid/access-web
        file_server
    }

    @library_root {
        remote_ip 10.253.0.0/16 10.254.0.0/16 10.250.100.0/24 10.250.101.0/24 10.71.100.84/32
        path /library
    }
    handle @library_root {
        redir /library/ 308
    }

    @library_allowed {
        remote_ip 10.253.0.0/16 10.254.0.0/16 10.250.100.0/24 10.250.101.0/24 10.71.100.84/32
        path /library/*
    }
    handle @library_allowed {
        header Content-Security-Policy "default-src 'none'; style-src 'unsafe-inline'; img-src 'self' data:; script-src 'unsafe-inline'; base-uri 'none'; frame-ancestors 'none'"
        uri strip_prefix /library
        reverse_proxy 127.0.0.1:18081
    }

    @library_denied path /library /library/*
    handle @library_denied {
        respond "not found" 404
    }

    @yookassa_webhook {
        method POST
        path /v2/billing/yookassa/webhook
    }
    handle @yookassa_webhook {
        reverse_proxy 10.71.100.83:18080
    }

    @account_billing_collection {
        method GET POST
        path /v2/account/billing/payments
    }
    handle @account_billing_collection {
        reverse_proxy 10.71.100.83:18080
    }

    @account_billing_payment {
        method GET
        path_regexp ^/v2/account/billing/payments/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$
    }
    handle @account_billing_payment {
        reverse_proxy 10.71.100.83:18080
    }

    @account_billing_retirements {
        method PUT
        path /v2/account/billing/pending-retirements
    }
    handle @account_billing_retirements {
        reverse_proxy 10.71.100.83:18080
    }

    @account_referrals_collection {
        method GET POST
        path /v2/account/referrals
    }
    handle @account_referrals_collection {
        reverse_proxy 10.71.100.83:18080
    }

    @account_referrals_reissue {
        method POST
        path_regexp ^/v2/account/referrals/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/share-token/reissue$
    }
    handle @account_referrals_reissue {
        reverse_proxy 10.71.100.83:18080
    }

    @account_referrals_revoke {
        method POST
        path_regexp ^/v2/account/referrals/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/revoke$
    }
    handle @account_referrals_revoke {
        reverse_proxy 10.71.100.83:18080
    }

    @magic_recovery_api {
        method POST
        path /v2/auth/magic-link/recovery /v2/auth/magic-link/resend
    }
    handle @magic_recovery_api {
        reverse_proxy 10.71.100.83:18080
    }

    @bulk_invite_api {
        method POST
        path /v2/auth/bulk-invites/inspect /v2/auth/bulk-invites/redeem
    }
    handle @bulk_invite_api {
        reverse_proxy 10.71.100.83:18080
    }

    @account_support_message {
        method POST
        path /v2/account/support-message
    }
    handle @account_support_message {
        reverse_proxy 10.71.100.83:18080
    }

    @public_api path /v2/auth/login/request /v2/auth/magic-link/consume /v2/auth/invites/inspect /v2/auth/invites/redeem /v2/auth/invites/resend /v2/auth/invites/change-email /v2/auth/logout /v2/account/me /v2/account/profiles /v2/account/profiles/*
    handle @public_api {
        reverse_proxy 10.71.100.83:18080
    }

    handle {
        respond "not found" 404
    }
}

https://admin.secret-studio.ru {
    tls /etc/caddy/admin-tls/admin.secret-studio.ru.crt /etc/caddy/admin-tls/admin.secret-studio.ru.key

    header {
        Cache-Control "no-store, max-age=0"
        Pragma "no-cache"
        Referrer-Policy "no-referrer"
        X-Content-Type-Options "nosniff"
        X-Frame-Options "DENY"
        Content-Security-Policy "default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; connect-src 'self'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'"
    }

    @trusted_health {
        remote_ip 10.250.100.0/24 10.250.101.0/24
        path /health
    }
    handle @trusted_health {
        respond "admin-ok" 200
    }

    @trusted_root {
        remote_ip 10.250.100.0/24 10.250.101.0/24
        path /
    }
    handle @trusted_root {
        root * /srv/wg-paid/admin-web
        rewrite * /index.html
        file_server
    }

    @trusted_assets {
        remote_ip 10.250.100.0/24 10.250.101.0/24
        path /assets/*
    }
    handle @trusted_assets {
        root * /srv/wg-paid/admin-web
        file_server
    }

    @trusted_admin_api {
        remote_ip 10.250.100.0/24 10.250.101.0/24
        path /v2/admin/*
    }
    handle @trusted_admin_api {
        reverse_proxy 10.71.100.83:18080
    }

    handle {
        respond "not found" 404
    }
}
