XFEServerManager

# Replace the hostname and certificate policy for your environment. Keep the
# management listener private; trustedProxies in XFEServerManager must contain
# only this proxy's address/CIDR.
admin.minecraft.example.com {
    encode zstd gzip

    @private not remote_ip 10.0.0.0/8 192.168.0.0/16 2001:db8:1234::/48
    respond @private 403

    # The environment override is used by compose.yaml.example. When Caddy runs
    # directly on the Minecraft host, the loopback default remains safest.
    reverse_proxy {$XFESM_UPSTREAM:127.0.0.1:8765} {
        header_up X-Forwarded-Proto {scheme}
        header_up X-Forwarded-Host {host}
        header_up X-Forwarded-For {remote_host}

        # SSE must not be buffered and benefits from a long-lived connection.
        flush_interval -1
    }

    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains"
        X-Content-Type-Options nosniff
        Referrer-Policy no-referrer
    }
}