# Caddy on the runner host (docker-compose.yml's `caddy`), as
# /etc/knotless/Caddyfile: TLS for the runner's bot login, and only that.
# The rest of what knotless-serve answers is not served from this host.
{$KNOTLESS_RUNNER_DOMAIN} {
	@bots path /oauth/bot /oauth/bot-callback /oauth/bot-client-metadata.json
	handle @bots {
		reverse_proxy bots:2590
	}
	handle {
		respond "This host runs knotless workflows; it serves nothing else." 404
	}
}