:80 {
	# Same-origin API: the api-client uses relative URLs, so the browser calls this origin and Caddy
	# forwards to the BFF — no CORS, and the DigiD token is attached by the app interceptor
	# (S-08d/ADR-0010).
	# `handle` blocks are mutually exclusive and matched most-specific-first, so the
	# SPA fallback below can never swallow an API call — unlike a bare `try_files`,
	# which Caddy sorts *before* reverse_proxy and would rewrite it to /index.html.
	#
	# No `resolver` stanza is needed: Caddy dials the upstream per
	# request through the system resolver, so it starts before the BFF is up, picks up
	# its restarts, and honours the DNS search domains in /etc/resolv.conf — which is
	# what lets the bare `bff` name resolve on Kubernetes as well as under compose.
	handle /self-service/* {
		reverse_proxy bff:8080
	}
	handle /openbaar/* {
		reverse_proxy bff:8080
	}

	# The Angular app. Client-side routing: an unknown path serves index.html.
	handle {
		root * /usr/share/caddy
		try_files {path} /index.html
		file_server
	}
}
