Caddyfile.multitenant

# AUTH0_DOMAIN must match steward_acs AUTH0_* env vars.
# Authorize redirects use per-host audience https://{host}/mcp/sse (multi-tenant).
# OAuth routes for Auth0 MCP connector integration
(oauth_routes) {
    # Serve OAUTH authorization server metadata (Claude discovers endpoints here)
    @wk_oauth_auth path /.well-known/oauth-authorization-server*
    handle @wk_oauth_auth {
        header Content-Type "application/json"
        respond `{"issuer":"https://{host}/","authorization_endpoint":"https://{host}/authorize","token_endpoint":"https://{host}/token","registration_endpoint":"https://{host}/oidc/register","jwks_uri":"https://{$AUTH0_DOMAIN}/.well-known/jwks.json","logo_uri":"https://{host}/favicon.png","response_types_supported":["code"],"response_modes_supported":["query"],"grant_types_supported":["authorization_code","refresh_token"],"scopes_supported":["mcp:tools"]}`
    }

    # OAuth broker: /authorize, /oauth/callback, /token are served by ACS
    # (lib/acs/mcp/oauth/broker.ex). ACS accepts ANY client redirect_uri and
    # performs the Auth0 handshake itself with a single fixed callback, so no
    # per-software Auth0 callback registration is needed. Keep these paths out
    # of the blocks below so they fall through to the ACS upstream.

    # Per-host audience must match ACS oauth-protected-resource metadata (multi-tenant).
    # Do not force connection= — Auth0 UL offers email OTP and/or Google for enabled clients.

    # DCR: fall through to ACS (fixed client via OAUTH_FIXED_DCR_CLIENT_ID).
    # Do not proxy /oidc/register to Auth0 — that creates a new third-party app
    # on every Claude connect until the tenant hits too_many_entities.
}

# mind_chat — MIND questionnaire chatbot app (chat_mind container)
mind.fourthsector.org.bt {
    reverse_proxy chat_mind:4000
}

mind_chat.{$BASE_DOMAIN} {
    tls /etc/caddy/certs/origin.pem /etc/caddy/certs/origin.key
    reverse_proxy chat_mind:4000
}

# Wildcard TLS — origin cert must cover *.{$BASE_DOMAIN}
# Apex {$BASE_DOMAIN} is the Astro marketing site (not this Caddy). ACS serves
# tenants + ACCOUNT_HOST (prod.stewardacs.xyz) on the wildcard only.
*.{$BASE_DOMAIN} {
    tls /etc/caddy/certs/origin.pem /etc/caddy/certs/origin.key
    import oauth_routes
    # Blue/green ACS upstream — deploy rewrites caddy/acs_upstream.caddyfile + reload.
    import /etc/caddy/acs_upstream.caddyfile
}