# FrankenPHP Caddyfile for the ui container.
# Serves Slim from public/ on :8080.
{
    frankenphp
    order php_server before file_server
    auto_https off
    admin off
    servers {
        trusted_proxies static private_ranges
    }
}

:8080 {
    root * /app/public
    encode zstd gzip

    # ── Security headers (M14) ──────────────────────────────────────────
    # CSP is set per-response by `App\Http\CspMiddleware` so the
    # `script-src 'nonce-…'` value can change per request, dropping
    # `'unsafe-inline'` / `'unsafe-eval'` (SEC_REVIEW F24).
    header {
        -Server
        -X-Powered-By
        X-Content-Type-Options "nosniff"
        X-Frame-Options "DENY"
        Referrer-Policy "strict-origin-when-cross-origin"
        Permissions-Policy "geolocation=(), microphone=(), camera=()"
    }

    @prod expression `{env.APP_ENV} == "production"`
    header @prod Strict-Transport-Security "max-age=31536000; includeSubDomains"

    php_server
}