From eb72ab4f03a844c22711ba43efe29777a5d2a7fc Mon Sep 17 00:00:00 2001
From: hermes <hermes@obahan.xyz>
Date: Wed, 30 Sep 2026 21:59:34 +0200
Subject: [PATCH] add vps/Caddyfile

---
 vps/Caddyfile | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 vps/Caddyfile

diff --git a/vps/Caddyfile b/vps/Caddyfile
new file mode 100644
index 0000000..73c62f3
--- /dev/null
+++ b/vps/Caddyfile
@@ -0,0 +1,13 @@
+# Caddy TLS termination for the radio stream.
+# Caddy auto-issues/renews Let's Encrypt certs. Replace radio.example.com.
+#
+# NOTE (learned the hard way on wiki-jokes): the app/origin must not fight
+# Caddy over headers. Caddy adds security headers; icecast's own are fine.
+
+radio.example.com {
+	# Stream + static files: proxy everything to icecast (serves webroot too).
+	reverse_proxy icecast:8000
+
+	# Stream-friendly: no buffering weirdness for long-lived connections.
+	header X-Robots-Tag "noindex"
+}