---
# Required
caddy_site_name: ""             # file basename -> <name>.conf
caddy_site_domain: ""           # site address line; may hold several, comma separated

# Pick exactly one shape
caddy_site_upstream: ""         # "localhost:3000" -> reverse_proxy
caddy_site_root: ""             # filesystem path  -> root * + file_server
caddy_site_body: ""             # raw escape hatch for one-off sites; wins over both

# reverse_proxy modifiers
caddy_site_resolvers: ""        # "100.100.100.100" for Tailscale MagicDNS
caddy_site_headers_up: {}       # {"X-Forwarded-Host": "wallet.example.com"}
# A LIST, not a dict: Ansible does not template dict *keys*, so a Jinja
# expression for the username silently passes through as literal text.
caddy_site_basic_auth: []       # [{user: "{{ x_user }}", hash: "{{ x_hash }}"}]

# Placement. caddy_sites_dir comes from services_config.yml; this is the fallback.
caddy_sites_dir: /etc/caddy/sites-enabled

# Rendered site files can carry credentials (basic_auth hashes), so --diff is
# suppressed by default. Pass -e caddy_site_reveal=true to see what moved.
caddy_site_reveal: false