# -- reverse proxy: single entrypoint, same-origin for webui + API -------
  # Required when the webui is deployed: the prebuilt webui image bakes a
  # same-origin '/api/v1' base URL and only serves static assets, so a proxy
  # must route /api, /health and /rest to the backend.
  caddy:
    image: caddy:2-alpine
    restart: unless-stopped
    ports:
@CADDY_PORTS@
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
      - caddy_config:/config
    depends_on:
      - api
      - webui