initial commit

Caddyfile.example

@@ -0,0 +1,15 @@
+# Example Caddyfile site block for the zeitkort web app.
+# Caddy handles TLS automatically via Let's Encrypt.
+#
+# Access control is done HERE (the app itself has no login screen): only the
+# listed IPs/ranges reach it. Everyone else gets 403.
+
+zeit.example.com {
+	@allowed remote_ip 203.0.113.4 198.51.100.0/24
+	handle @allowed {
+		reverse_proxy 127.0.0.1:8081
+	}
+	respond "Forbidden" 403
+}
+
+# This web-only POC has no separate API/backend service.