:80 {
	# Same-origin API: beheerders use the same medewerker realm as behandel (S-15a).
	# `handle` blocks are mutually exclusive and matched most-specific-first, so the
	# SPA fallback below can never swallow an API call — unlike a bare `try_files`,
	# which Caddy sorts *before* reverse_proxy and would rewrite it to /index.html.
	#
	# No `resolver` stanza is needed: Caddy dials the upstream per
	# request through the system resolver, so it starts before the BFF is up, picks up
	# its restarts, and honours the DNS search domains in /etc/resolv.conf — which is
	# what lets the bare `bff` name resolve on Kubernetes as well as under compose.
	handle /beheer/* {
		reverse_proxy bff:8080
	}

	# The Angular app. Client-side routing: an unknown path serves index.html.
	handle {
		root * /usr/share/caddy
		try_files {path} /index.html
		file_server
	}
}