Update Reverse proxy and TLS configuration on Caddy

src/functions/backend/caddy/build-caddyfile.test.ts

@@ -37,11 +37,22 @@ describe("buildCaddyfile", () => {
 
         expect(res.config).toContain("https_port 8443");
         expect(res.config).toContain("http_port 8081");
-        expect(res.config).toContain("auto_https disable_redirects");
+        expect(res.config).not.toContain("auto_https disable_redirects");
         expect(res.config).not.toContain("https_port 443");
         expect(res.config).not.toContain("http_port 80\n");
     });
 
+    test("can disable automatic HTTPS redirects", () => {
+        const res = buildCaddyfile({
+            ...base,
+            redirect: false,
+            routes: [],
+            certificates: [],
+        });
+
+        expect(res.config).toContain("auto_https disable_redirects");
+    });
+
     test("orders longer prefixes before the catch-all", () => {
         const res = buildCaddyfile({
             ...base,
@@ -88,6 +99,25 @@ describe("buildCaddyfile", () => {
         expect(res.config).toContain("remote_ip 10.5.0.0/24");
     });
 
+    test("appends route allowed_ips to the remote_ip matcher", () => {
+        const res = buildCaddyfile({
+            ...base,
+            certificates: [certificate],
+            hosts: [{ id: 0, wg_ip_address: "10.5.0.1" }],
+            routes: [
+                route({
+                    host_id: 0,
+                    path_prefix: "/app",
+                    allowed_ips: "203.0.113.0/24, 198.51.100.0/24",
+                }),
+            ],
+        });
+
+        expect(res.config).toContain(
+            "remote_ip 10.5.0.0/24 127.0.0.1/32 ::1/128 203.0.113.0/24 198.51.100.0/24",
+        );
+    });
+
     test("maps insecure upstream TLS to Caddy", () => {
         const res = buildCaddyfile({
             ...base,
@@ -102,4 +132,22 @@ describe("buildCaddyfile", () => {
 
         expect(res.config).toContain("tls_insecure_skip_verify");
     });
+
+    test("allows a catch-all route with allowed_ips to have a matcher", () => {
+        const res = buildCaddyfile({
+            ...base,
+            certificates: [certificate],
+            hosts: [{ id: 0, wg_ip_address: "10.5.0.1" }],
+            routes: [
+                route({
+                    host_id: 0,
+                    path_prefix: "/",
+                    allowed_ips: "203.0.113.0/24",
+                }),
+            ],
+        });
+
+        expect(res.config).toContain("@route_1 remote_ip");
+        expect(res.config).toContain("203.0.113.0/24");
+    });
 });