:443 {
  tls /etc/caddy/certs/agentdock.crt /etc/caddy/certs/agentdock.key

  @outside_lan not remote_ip 192.168.200.0/24 127.0.0.1/32
  respond @outside_lan "Forbidden" 403

  encode zstd gzip
  reverse_proxy ai-console:4173

  header {
    Strict-Transport-Security "max-age=31536000"
    -Server
  }
}