/**
 * Caddy image recipe — automatic HTTPS reverse proxy (simplest TLS path).
 *
 * Opt-in via `images.proxy`. Emits a `Caddyfile` that terminates TLS and
 * reverse-proxies to the compose `app` service on {@link APP_PORT}.
 */

import { APP_PORT } from "../../runtime/types.ts";
import type { ImageRecipe } from "../types.ts";

/** Compose service name for the application container. */
export const CADDY_APP_SERVICE = "app";

/**
 * Build a minimal Caddyfile — automatic HTTPS for `OKE_PROXY_HOST`.
 *
 * @param opts - Upstream app port on the compose network
 */
export function buildCaddyfile(opts: { readonly appPort?: number } = {}): string {
  const port = opts.appPort ?? APP_PORT;
  return [
    "# Generated by `oke docker` — edit via compose.override.yml / replace this file.",
    "# Set OKE_PROXY_HOST to your public hostname (Let's Encrypt). localhost → local TLS.",
    "{$OKE_PROXY_HOST:localhost} {",
    `	reverse_proxy ${CADDY_APP_SERVICE}:${port}`,
    "}",
    "",
  ].join("\n");
}

/** Caddy reverse proxy. HTTP 80 + HTTPS 443. */
export const caddy: ImageRecipe = {
  id: "caddy",
  port: 80,
  match: (i) => /caddy/i.test(i),
  apply: (s) => ({
    extraPorts: [{ host: 443, container: 443 }],
    volumes: [
      "./Caddyfile:/etc/caddy/Caddyfile:ro",
      `${s.serviceName}-data:/data`,
      `${s.serviceName}-config:/config`,
    ],
    healthcheck: {
      test: ["CMD", "caddy", "version"],
      interval: "10s",
      timeout: "3s",
      retries: 5,
    },
  }),
  url: (_s, c) => `https://${c.host}`,
};