aibook.fun {

    # AIBook.fun is a static marketing site — pure reverse proxy to the Next.js
    # standalone server. No auth/headers added here beyond baseline security.
    reverse_proxy web:3000

    log {
        # Host-bind-mounted /var/log/caddy/ so logs survive container recreation.
        output file /var/log/caddy/aibook-fun.log
    }

    header {
        # Force HTTPS for a year (HSTS — a lapsed cert is a service outage, not a
        # warning; weown rail per W24 phase4 findings).
        Strict-Transport-Security "max-age=31536000; includeSubDomains"
        X-Content-Type-Options nosniff
        X-Frame-Options SAMEORIGIN
        X-XSS-Protection "1; mode=block"
        Referrer-Policy strict-origin-when-cross-origin
        -Server
    }
}