From 3bfa9ac65ebadd49166138050703ee58af60301d Mon Sep 17 00:00:00 2001
From: -Puter <22245429+puterhimself@users.noreply.github.com>
Date: Sun, 26 Jul 2026 01:41:50 +0530
Subject: [PATCH] deploy(caddy): reverse-proxy zopu chat + API behind
 zopu.cheaptricks.puter.wtf

---
 deploy/zopu-runtime/caddy/Caddyfile | 37 ++++++++++-------------------
 1 file changed, 13 insertions(+), 24 deletions(-)

diff --git a/deploy/zopu-runtime/caddy/Caddyfile b/deploy/zopu-runtime/caddy/Caddyfile
index 7d5192b..5b45a30 100644
--- a/deploy/zopu-runtime/caddy/Caddyfile
+++ b/deploy/zopu-runtime/caddy/Caddyfile
@@ -1,26 +1,15 @@
-# Caddyfile — Minimal reverse proxy for the Zopu agent service.
+# Caddyfile — Public reverse proxy for the Zopu chat + API.
 #
-# This is OPTIONAL. The agent service does not need to be publicly exposed
-# for the execution plane to function. Use Caddy only when an HTTP endpoint
-# is genuinely needed (e.g., a webhook ingress from Convex site functions).
-#
-# In the default single-node deployment, the agent listens on localhost:3583
-# and is reachable over Tailscale. Install Caddy only if you need TLS
-# termination or a public ingress point.
-#
-# --- Private/Tailscale deployment (recommended) ---
-#
-# Listen only on the Tailscale interface. Replace the hostname with your
-# Tailscale machine name or IP.
-#
-# http://zopu-runtime.tail-xxxx.ts.net {
-#     reverse_proxy localhost:3583
-# }
-#
-# --- Public deployment with automatic TLS (only if needed) ---
-#
-# agent.example.invalid {
-#     reverse_proxy localhost:3583
-# }
+# The web frontend (port 5174) is served at the root, and the agent/API
+# (port 3590) is mounted under /api so the browser talks same-origin.
 
-# Default: do not ship an active Caddyfile. The file is documentation.
+zopu.cheaptricks.puter.wtf {
+	bind 135.181.82.179 2a01:4f9:c013:4a64::1
+	encode zstd gzip
+
+	handle_path /api/* {
+		reverse_proxy 127.0.0.1:3590
+	}
+
+	reverse_proxy 127.0.0.1:5174
+}