Update scripts/generate-caddyfile.sh

scripts/generate-caddyfile.sh

@@ -225,7 +225,18 @@ with open(caddy_file, "a", encoding="utf-8") as f:
 
         rules = rules_by_app.get(app_id, [])
         safe_name = safe_matcher_name(app_id)
+
+        f.write(f"    route /apps/{app_id}/* {{\n")
+
+        # Public endpoints are always open and are handled before IP rules.
         open_paths = [f"/apps/{app_id}{suffix}" for suffix in OPEN_PATH_SUFFIXES]
+        f.write(f"        @open_{safe_name} {{\n")
+        f.write("            path " + " ".join(open_paths) + "\n")
+        f.write("        }\n")
+        f.write(f"        handle @open_{safe_name} {{\n")
+        f.write(f"            uri strip_prefix /apps/{app_id}\n")
+        f.write(f"            reverse_proxy {app_id}:{port}\n")
+        f.write("        }\n\n")
 
         if rules:
             allowed_by_method = {method: [] for method in ALL_METHODS}
@@ -246,14 +257,12 @@ with open(caddy_file, "a", encoding="utf-8") as f:
                 matcher = f"blocked_{safe_name}_{method.lower()}"
 
                 f.write(f"        @{matcher} {{\n")
-                f.write(f"        path /apps/{app_id}/*\n")
                 f.write(f"            method {method}\n")
-                f.write("        not path " + " ".join(open_paths) + "\n")
                 f.write("            not remote_ip " + " ".join(allowed_ips) + "\n")
                 f.write("        }\n")
                 f.write(f"        respond @{matcher} \"Forbidden\" 403\n\n")
 
-        f.write(f"    handle_path /apps/{app_id}/* {{\n")
+        f.write(f"        uri strip_prefix /apps/{app_id}\n")
         f.write(f"        reverse_proxy {app_id}:{port}\n")
         f.write("    }\n\n")
 PY