Caddyfile

{$DOMAIN_NAME} {
    reverse_proxy /api* http://api:8000
    reverse_proxy /graphql* http://caluma:8000
    reverse_proxy /auth* http://keycloak:8080
    reverse_proxy /caluma-media* http://minio:9000
    reverse_proxy /minio/* http://minio:9000
    reverse_proxy /* http://ember:80
    {$GRAPHIQL_PROXY}

    @monitoring {
        remote_ip forwarded private_ranges {$MONITORING_IPS}
    }
    handle @monitoring {
        reverse_proxy /healthz* http://caluma:8000
    }

    log {
        output stdout
    }
    encode gzip

    # generated 2021-02-04, Mozilla Guideline v5.6, Caddy 2.1.1, intermediate configuration
    # https://ssl-config.mozilla.org/#server=caddy&version=2.1.1&config=intermediate&guideline=5.6

    header / Strict-Transport-Security "max-age=63072000"

    # Due to a lack of DHE support, you -must- use an ECDSA cert to support IE 11 on Windows 7
    tls {
        protocols tls1.2 tls1.3
        ciphers TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
    }
}