#!/bin/sh
set -eu

TARGET_URL="${TARGET_URL:-}"
LISTEN_PORT="${LISTEN_PORT:-8080}"
PROXY_INSECURE_TLS="${PROXY_INSECURE_TLS:-0}"
PRESERVE_HOST="${PRESERVE_HOST:-0}"

if [ -z "$TARGET_URL" ]; then
  echo "TARGET_URL is required (e.g. https://internal.example.com)" >&2
  exit 1
fi

case "$TARGET_URL" in
  http://*|https://*) ;;
  *)
    echo "TARGET_URL must start with http:// or https://" >&2
    exit 1
    ;;
esac

# Strip trailing slash so paths concatenate cleanly
TARGET_URL="${TARGET_URL%/}"

CADDYFILE="/etc/caddy/Caddyfile"
mkdir -p /etc/caddy

EXTRA_DIRECTIVES=""

if [ "$PRESERVE_HOST" = "1" ]; then
  EXTRA_DIRECTIVES="${EXTRA_DIRECTIVES}
		header_up Host {http.request.host}"
fi

if [ "$PROXY_INSECURE_TLS" = "1" ]; then
  EXTRA_DIRECTIVES="${EXTRA_DIRECTIVES}
		transport http {
			tls_insecure_skip_verify
		}"
fi

cat > "$CADDYFILE" <<EOF
{
	admin off
	auto_https off
}

:${LISTEN_PORT} {
	reverse_proxy ${TARGET_URL} {${EXTRA_DIRECTIVES}
	}
}
EOF

echo "Proxying :${LISTEN_PORT} -> ${TARGET_URL}"
if [ "$PROXY_INSECURE_TLS" = "1" ]; then
  echo "TLS verification disabled for upstream"
fi

exec caddy run --config "$CADDYFILE" --adapter caddyfile