{
	# Bound to the container's own loopback rather than turned off.
	#
	# Off would be marginally safer, but `caddy reload` talks to this endpoint,
	# and without it every config change means restarting the container and
	# dropping live connections. localhost:2019 is not published by the compose
	# file and not reachable across the Docker network, so reaching it requires
	# already having root on the host — at which point the admin API is not the
	# weak link.
	admin localhost:2019

	# Let's Encrypt certificates are issued and renewed automatically for every
	# hostname in conf.d/. Nothing to renew, nothing to remember.
	#
	# No contact address on purpose: it would only ever receive expiry warnings
	# that cannot happen here, and it is one less identifier attached to this
	# box.

	servers {
		protocols h1 h2 h3
	}
}

# Server-wide Caddy config.
# ---------------------------------------------------------------------------
# This file deliberately contains nothing about any particular site. Every
# project on this box drops its own file into conf.d/ and reloads; this one
# only sets what is true for the whole machine.
#
# That separation is the point. Adding cheri.ro or agoreni.ro later means one
# new file in conf.d/ and a DNS record — no edit here, nothing to overwrite,
# and no way for one site's mistake to take another down, because Caddy
# validates the entire set before it will load any of it.
#
# The global options block has to come first in a Caddyfile, before anything
# else including this comment — putting the explanation above it is what makes
# Caddy warn that the input is not formatted on every single reload.

# Every site on this box.
import /etc/caddy/conf.d/*.caddy