# Development mode config
# https://frankenphp.dev/docs/config
# https://caddyserver.com/docs/caddyfile

{
    skip_install_trust

    frankenphp {

    }
}

{$SERVER_NAME::80} {
    encode zstd br gzip

    # F11, closed round 615. Nothing at the edge bounded a request body, and
    # Caddy has no default limit of its own — so the only bound on a PUBLIC,
    # unauthenticated, whole-stream-buffering endpoint (/careers/{tenant}/jobs/{id})
    # was PHP's compiled post_max_size, a value nothing stated, tested, or would
    # have noticed changing.
    #
    # 20MB is go-humanize's SI megabyte: 20,000,000 bytes. That is deliberately
    # ABOVE post_max_size (16M = 16,777,216) so PHP's own error path handles the
    # in-band cases and this only stops what should never have been sent. Over it,
    # Caddy answers 413 without occupying a PHP worker.
    #
    # UploadLimitChainTest asserts this stays above post_max_size, which in turn
    # stays above upload_max_filesize, which stays above every MAX_BYTES the
    # domain declares. Loosening any one of them alone fails the build.
    request_body {
        max_size 20MB
    }

    # Round 805: the cap above never fires under FrankenPHP — see
    # docker/Caddyfile, where it was measured. The same refusal on the
    # declared length, before PHP is involved.
    @declaredOverTheCap expression {http.request.header.Content-Length} != "" && int({http.request.header.Content-Length}) > 20000000
    handle @declaredOverTheCap {
        method GET
        rewrite * /413.html
        file_server {
            root /app/public
            status 413
        }
    }


    # Cham's decision (2026-09-09): a body over the cap gets a PAGE, not a bare
    # status line. Caddy's default 413 body is empty, so a candidate whose phone
    # photo is 25MB sees a blank screen and learns nothing.
    #
    # Static, deliberately: the whole point of stopping it here is that no PHP
    # worker is occupied, and routing the error page through php_server would
    # give that back on exactly the requests designed to exhaust it.
    #
    # **AUTHORED AND UNEXECUTED**, like the `request_body` cap above it. See the
    # production Caddyfile's note.
    handle_errors 413 {
        method GET
        rewrite * /413.html
        file_server {
            root /app/public
        }
    }

    php_server {
        try_files {path} index.php
        root /app/public
    }
}
