# Terminates TLS in front of the app. Only used by the `tls` compose profile;
# `docker compose up` on its own serves plain http on OAPKH_PORT for local work.
#
# Both values come from .env. Caddy obtains and renews a certificate for
# OAPKH_DOMAIN automatically, which is what makes a Play Store release build able
# to connect at all: release builds set cleartextTrafficPermitted="false" and
# refuse http:// instance URLs outright.

{$OAPKH_DOMAIN} {
	tls {$OAPKH_TLS_EMAIL}

	# APKs are large and uploads are slow; the defaults would cut them off.
	request_body {
		max_size {$OAPKH_MAX_UPLOAD_BYTES:524288000}
	}

	reverse_proxy app:8080 {
		transport http {
			read_timeout 30m
			write_timeout 30m
		}
	}
}