:7860 {
    # Route WebSocket streams (iii-stream on 3112)
    # Keep full path — iii-stream expects /stream/mem-live/viewer
    handle /stream/* {
        reverse_proxy localhost:3112 {
            header_up Host localhost:3112
            header_up Authorization "Bearer {env.AGENTMEMORY_SECRET}"
        }
    }

    # Route REST API endpoints (iii-http on 3111)
    # Caddy injects the secret so the dashboard viewer works without exposing it to the browser
    handle /agentmemory/* {
        reverse_proxy localhost:3111 {
            header_up Host localhost:3111
            header_up Authorization "Bearer {env.AGENTMEMORY_SECRET}"
        }
    }

    # Route Viewer dashboard (on 3113)
    handle {
        reverse_proxy localhost:3113 {
            header_up Host localhost:3113
        }
    }
}