# Provenance edge. Site address is env-driven: ':80' for local http://localhost,
# a domain in production for automatic HTTPS. Behind a Cloudflare Tunnel you can
# keep this on plain HTTP and let the tunnel terminate TLS.

{$PROVENANCE_SITE_ADDRESS::80} {
	encode gzip

	# Versioned API surface (FastAPI). The assistant mounts under /assistant later.
	handle /api/* {
		reverse_proxy backend:8000
	}

	# Liveness/readiness probes, proxied for external monitoring.
	handle /health* {
		reverse_proxy backend:8000
	}

	# Frontend (Next.js) — not yet deployed in Phase 0. Uncomment when it lands.
	# handle {
	#	reverse_proxy frontend:3000
	# }
	handle {
		respond "Provenance — Phase 0. Backend health at /health; frontend not yet deployed." 200
	}
}