Caddyfile

# One site address drives everything: https://your.domain gets automatic
# HTTPS; http://localhost is plain HTTP for a local try-out.
{$SITE_URL} {
	encode zstd gzip

	# Uploads: served from the content store when the file is there, otherwise
	# from the built site (the theme's own sample media lives there), before
	# the Indiekit media endpoint below can claim the prefix.
	@upload {
		path /media/*
		file {
			root /srv/content
		}
	}
	handle @upload {
		root * /srv/content
		file_server
		header Cache-Control "public, max-age=2592000, immutable"
	}
	@site_media {
		path /media/*
		file {
			root /srv/site
		}
	}
	handle @site_media {
		root * /srv/site
		file_server
	}

	# Indiekit: its endpoints and its admin interface. The site keeps /,
	# robots.txt, the feeds and its own assets.
	#
	# Indiekit redirects any request whose X-Forwarded-Proto is not https. On a
	# plain-HTTP local try-out that would redirect forever, so the header is
	# dropped when the address scheme is http; nothing else in Indiekit reads it.
	# Over HTTPS it is passed through and the redirect never fires.
	@indiekit_plain {
		path /micropub* /auth* /media* /files* /image* /posts* /share* /syndicate* /webmentions* /microsub* /session* /status* /assets* /id /plugins* /feed.jf2 /app.webmanifest /serviceworker.js /offline /.well-known/oauth-authorization-server
		expression {scheme} == "http"
	}
	handle @indiekit_plain {
		reverse_proxy indiekit:3000 {
			header_up -X-Forwarded-Proto
		}
	}
	@indiekit path /micropub* /auth* /media* /files* /image* /posts* /share* /syndicate* /webmentions* /microsub* /session* /status* /assets* /id /plugins* /feed.jf2 /app.webmanifest /serviceworker.js /offline /.well-known/oauth-authorization-server
	handle @indiekit {
		reverse_proxy indiekit:3000
	}

	# The site.
	handle {
		root * /srv/site
		try_files {path} {path}/ {path}.html
		file_server
	}

	handle_errors {
		@notfound expression {http.error.status_code} == 404
		rewrite @notfound /404.html
		root * /srv/site
		file_server
	}
}