Run identity and access
on your own terms

How to enable

1. Register an app: add an OIDC client or a SAML service provider under Applications in the admin console.
2. Connect your directory: add an LDAP / FreeIPA source under Sources, then sync users and groups on demand or a timer.
3. Shape the token: map directory groups and roles into the roles / groups claims with property mappings. A fresh install comes seeded with the standard mapping set (roles, groups, ldap_ipa_roles, login, user_attributes, entitlements) already present and editable — a deleted one is never re-created, so your changes stick.
4. For apps that only speak LDAP, turn on the LDAP server listener (BROKER_LDAP_BIND) and give them the read-only service bind DN.
5. Tighten tokens with BROKER_SCOPE_ENFORCE so every client only ever receives the scopes it is registered for.
6. Tune lifetimes without a restart: Settings → Token & session lifetimes sets the access-token, refresh-token and SSO session idle/absolute windows. Each value is clamped to a safe range on save, so a typo can't mint an instantly-expiring or effectively-immortal token.

Works with

• Device posture & trust tiers — device health and step-up layer on top of the login
• Transparency log & CAEP — every sign-in decision and admin change is logged

Key settings

Example configuration

# Tighten token scopes + trust an extra verify key during rotation
BROKER_SCOPE_ENFORCE: "true"                    # only issue a client's registered scopes
BROKER_ADDITIONAL_VERIFY_KEYS_FILE: /keys/next_pub.pem
# Native SAML IdP (both key + cert enable it):
BROKER_SAML_KEY_FILE: /keys/saml_signing.pem
BROKER_SAML_CERT_FILE: /keys/saml_signing_cert.pem

How to enable

1. Passkeys and TOTP are self-service from the account portal — no extra flag beyond serving the portal.
2. For push and QR approvals, configure background push (FCM_SERVICE_ACCOUNT_FILE) and hand out the mobile app.
3. Offer password sign-in only where you need it with BROKER_PASSWORD_LOGIN; enable lost-device recovery with BROKER_RECOVERY_ENROL.
4. Brute-force is handled automatically: after BROKER_AUTH_LOCKOUT_THRESHOLD (default 10) wrong passwords/codes for an account in 15 minutes, further attempts are refused until they age out, a correct login clears it, and a brute-force risk event is recorded. Set BROKER_AUTH_IP_LOCKOUT_THRESHOLD to also lock by source IP (off by default — NAT-unsafe).
5. Keep DPoP opportunistic during rollout; once devices carry bound keys, set BROKER_DPOP_ENFORCE=true (walk the enforce checklist first).
6. Extend proof-of-possession to the app APIs with BROKER_DPOP_ENFORCE_API=true, so a stolen device-bound token can't be replayed against the core /api endpoints — flip it only after every device runs a client that sends /api proofs.

Works with

• Identity — OIDC, SAML, SCIM & LDAP — MFA sits on top of the primary login
• Device posture & trust tiers — device binding shares the same silent hardware key

Key settings

Example configuration

# Device-bound tokens + adaptive step-up
BROKER_DPOP_ENFORCE: "false"     # keep opportunistic during rollout; flip once devices carry keys
BROKER_ADAPTIVE_STEPUP: "true"   # ask for MFA only when risk warrants it
BROKER_APPROVAL_TTL_SECS: "120"
BROKER_RECOVERY_ENROL: "true"    # allow a recovery code to enrol a replacement device

How to enable

1. Posture is evaluated wherever a device reports it — the desktop tray and the mobile app do this automatically once enrolled.
2. Turn on the ingest endpoint with BROKER_AGENT_POSTURE_ENABLE=true so desktop clients can report.
3. Tune per-signal weights and the minimum passing score in the admin console (Posture) — the same model the client's health ring uses.
4. Decide how unknown devices are treated: set BROKER_POSTURE_UNKNOWN_FAIL_CLOSED=true and choose deny or step_up.
5. Optionally expire stale snapshots (BROKER_POSTURE_MAX_AGE_SECS) and cap non-trusted session lifetime (BROKER_LIMITED_TIER_TTL_SECS).

Works with

• MFA, passkeys & device-bound tokens — posture rides the same silent device key as token binding
• Desktop client — the desktop client collects and signs the signals

Key settings

Example configuration

# Report ingest + how unknown devices are treated
BROKER_AGENT_POSTURE_ENABLE: "true"
BROKER_POSTURE_UNKNOWN_FAIL_CLOSED: "true"
BROKER_POSTURE_UNKNOWN_ACTION: "step_up"    # deny | step_up
BROKER_LIMITED_TIER_TTL_SECS: "3600"        # cap non-trusted session lifetime (0 = off)

How to enable

1. Bind the connector listener (BROKER_CONNECTOR_BIND) with its TLS cert and set a registration key.
2. Enrol a connector under Connectors to mint a one-time token; run it beside the app with that token and its upstream allow-list.
3. Lock the pool: once enrolled, set BROKER_CONNECTOR_ENROLLED_ONLY=true so a leaked shared key can't join.
4. Turn on the browser edge with BROKER_CONNECTOR_ENABLE=true, then register each private app (web or raw-TCP).
5. Add an access rule for every private app before cutover — an app with zero rules fails closed and admits no one.

Works with

• Device posture & trust tiers — private-app access is posture-gated on each request
• Multi-site & VRF routing — site routing picks the connector when an app isn't pinned to one

Key settings

Example configuration

# Connectors dial OUT to these listeners; nothing inbound on app networks
BROKER_CONNECTOR_BIND: 0.0.0.0:9445           # connector registration (pinned TLS)
BROKER_CONNECTOR_ENABLE: "true"               # browser edge for web private apps
BROKER_CONNECTOR_ENROLLED_ONLY: "true"        # refuse the shared-key bootstrap after enrolment
BROKER_TCP_TUNNEL_BIND: 0.0.0.0:9446          # raw-TCP ingress (SSH/RDP/Postgres)

Run a connector beside the app

# Enrol a connector in the admin console to get its one-time token,
# then run it next to the app. Nothing inbound opens on this network.
docker run -d --name pramaan-connector --restart unless-stopped \
  -e CONNECTOR_BROKER_ADDR=id.example.com:9445 \
  -e CONNECTOR_REGISTRATION_KEY_FILE=/run/secrets/conn_key \
  -e CONNECTOR_SITE=hq-dc1 \
  -e CONNECTOR_UPSTREAMS=10.20.0.10:22,10.20.0.10:5432 \
  -e CONNECTOR_ALLOWED_CIDRS=10.20.0.0/24 \
  pramaan/connector:latest
#  CONNECTOR_UPSTREAMS  — the only hosts:ports this connector will reach (its allow-list)
#  CONNECTOR_SITE       — which routing domain it belongs to (VRF-aware)
#  CONNECTOR_BROKER_CA_FILE / _SNI — pin the broker's TLS cert on locked-down networks

How to enable

1. Run a connector inside the VM's network (or on the VM itself). Enrol it under Connectors for a one-time token, then set CONNECTOR_UPSTREAMS=tcp://<vm-ip>:22 — this allow-list is the whitelisting: the connector can dial that host and port and nothing else.
2. Bind the raw-TCP ingress on the broker with BROKER_TCP_TUNNEL_BIND, and make sure it is reachable by clients (front it with a TLS-passthrough listener on a public port; the default bind is loopback-only).
3. Register the SSH app (PUT /admin/tcp-apps or the console): an id, the upstream tcp://<vm-ip>:22, the connector_id, and the groups allowed to reach it.
4. Add an access rule for the app before anyone uses it — an app with no rule fails closed and admits no one. Posture is evaluated per connection, so a non-compliant device is refused (and revoked mid-session by the posture sweep).
5. Forward and connect. Desktop: pramaanctl forward ssh-vm 2222 then ssh user@127.0.0.1 -p 2222. Android: open the app, ZTNA apps → your SSH app → Forward, then point Termius at 127.0.0.1:2222.

Command-line (pramaanctl)

Client settings

Works with

• ZTNA — private apps & connectors — the connector, allow-list and access rules come from the ZTNA setup
• Device posture & trust tiers — every SSH connection is posture-gated, not just the first
• Mobile app — the phone app runs the on-device forwarder so Termius can reach the port

Key settings

Whitelist the VM on a connector

# 1. Run a connector inside the VM's network (or on the VM itself).
#    Enrol it under Connectors first to get its one-time token.
docker run -d --name pramaan-ssh-connector --restart unless-stopped \
  -e CONNECTOR_ID=vm-ssh-connector \
  -e CONNECTOR_BROKER_ADDR=id.example.com:9445 \
  -e CONNECTOR_REGISTRATION_KEY_FILE=/run/secrets/conn_key \
  -e CONNECTOR_UPSTREAMS=tcp://10.20.0.9:22 \
  -e CONNECTOR_BROKER_CA_FILE=/etc/pramaan/broker-ca.pem \
  pramaan/connector:latest
#  CONNECTOR_UPSTREAMS  — the ONLY target this connector will ever dial (SSH, one host:port).
#                         If the connector runs ON the VM, use tcp://127.0.0.1:22.
#  A destination not in this allow-list is refused — a compromised broker cannot pivot.

Register the app, forward, connect

# 2. Register the SSH app (admin API or console). Same shape as any raw-TCP app.
#    id/upstream/connector + the group allowed to reach it. Posture rules apply on top.
PUT /admin/tcp-apps
{
  "id": "ssh-vm",
  "name": "SSH — Linux VM",
  "upstream": "tcp://10.20.0.9:22",
  "connector_id": "vm-ssh-connector",
  "groups": ["ztna-ssh-vm"]
}

# 3a. Desktop — forward a local port, then point your SSH client at it.
export PRAMAAN_TCP_TUNNEL_ADDR=id.example.com:9446   # the raw-TCP ingress
pramaanctl login
pramaanctl forward ssh-vm 2222                        # opens 127.0.0.1:2222
ssh user@127.0.0.1 -p 2222                            # the VM's host key is pinned as usual

# 3b. Android (Termius on the same phone) — start the forwarder in the Pramaan app:
#     ZTNA apps -> "SSH - Linux VM" -> Forward. It shows 127.0.0.1:2222.
#     In Termius: Host 127.0.0.1, Port 2222. Keep Pramaan running in the background.

How to enable

1. Create a Site under Sites and add static routes — a CIDR like 10.1.0.0/16, an exact IP, a .suffix domain, a default 0.0.0.0/0, or *.
2. Assign each connector to its site at enrolment; the site on that record is authoritative.
3. Point a private app at the Site (leave its connector unpinned) — the broker routes by longest-prefix within the site.
4. For active/standby across two connectors that both reach a destination, set a metric on each route (lower = primary). Blank is neutral. A degraded connector is demoted automatically — tune the window with BROKER_ZTNA_CONNECTOR_STALE_SECS.
5. To let connectors contribute routes dynamically, turn on Accept learned routes for the site (or BROKER_ZTNA_TRUST_ADVERTISED_ROUTES=true for the whole fleet). Learned routes only fill gaps, never override static, and age out after the site's withdraw window.
6. Connectors re-advertise their reachable routes periodically (every CONNECTOR_ADVERTISE_SECS, default 30s) rather than only at connect time, so a route a connector stops advertising is withdrawn from routing even while its tunnel stays up — freshness is measured from the last advertisement, not from tunnel keepalives. Keep the cadence comfortably under the site's withdraw window.
7. BGP-at-connector (optional, import-only): a connector can learn its site's prefixes from a routing peer instead of hand-maintained routes. Set CONNECTOR_BGP_ENABLE=true plus CONNECTOR_BGP_PEER, CONNECTOR_BGP_PEER_ASN, CONNECTOR_BGP_LOCAL_ASN and CONNECTOR_BGP_ROUTER_ID. The connector opens ONE learn-only session — it never advertises anything back — and feeds the learned prefixes into the same gated learned-route channel above. Bound what it may accept with CONNECTOR_BGP_IMPORT_ALLOW (allowed supernets), CONNECTOR_BGP_MAX_PREFIXLEN and CONNECTOR_BGP_MAX_PREFIXES (the session is torn down on overflow); a default route is never learned. A learned route's BGP MED becomes its route metric (lower = preferred), so among equally-specific learned paths the lower-MED connector leads and the rest are failover — just like a static route's metric. So even a misbehaving peer can only gap-fill within the connector's own site, never override a static route or reach another VRF — the safety a raw BGP feed can't offer.

Works with

• ZTNA — private apps & connectors — sites are how apps select a connector without pinning one

Key settings

Example configuration

# Routing across VRFs / overlapping address space
BROKER_ZTNA_TRUST_ADVERTISED_ROUTES: "false"  # default: only admin static routes carry traffic
# (Sites, static routes and per-app routing are configured in the admin console.)

How to enable

1. Enable the app-less ingress on the broker with BROKER_ZTNA_L3_ENABLE=true and bind the raw-TCP tunnel (BROKER_TCP_TUNNEL_BIND).
2. Optionally require a dedicated scope on the tunnel token with BROKER_TCP_TUNNEL_REQUIRE_SCOPE=true.
3. Install the always-on desktop build (packaged with the L3 feature) and turn on Always-on from the client console — it needs administrator once to create the adapter.
4. Today always-on carries IP-based TCP apps; domain-based apps still use the per-app tunnel, and UDP to a protected destination is dropped fail-closed.

Works with

• ZTNA — private apps & connectors — L3 reuses the same connectors, sites and access rules
• Desktop client — the always-on datapath lives in the desktop client

Key settings

Example configuration

# Always-on transparent access (app-less ingress)
BROKER_ZTNA_L3_ENABLE: "true"
BROKER_TCP_TUNNEL_BIND: 0.0.0.0:9446
BROKER_TCP_TUNNEL_REQUIRE_SCOPE: "true"       # require the pramaan.tunnel scope on the token

How to enable

1. Set the master gate BROKER_SWG_ENABLE=true. For the web proxy add BROKER_SWG_PROXY_BIND; for DNS filtering add BROKER_SWG_DNS_BIND.
2. Load category feeds (BROKER_SWG_CATEGORY_DIR) and write access rules — the proxy refuses to start if a configured feed fails to load.
3. Turn on inline DLP with BROKER_DLP_ENABLE=true and an optional keyword file.
4. To inspect HTTPS, provide an inspection CA, set BROKER_SWG_TLS_INSPECT=true and list the categories to decrypt — it never decrypts outside that list.

Works with

• File-type control & sandbox — file-type control rides the decrypted inspection path
• Device posture & trust tiers — gateway decisions can be keyed to device posture

Key settings

Example configuration

# Secure Web Gateway: web proxy + private DNS filter
BROKER_SWG_ENABLE: "true"
BROKER_SWG_PROXY_BIND: 127.0.0.1:3128
BROKER_SWG_DNS_BIND: 127.0.0.1:5353
BROKER_SWG_CATEGORY_DIR: /swg/categories       # category rule feeds
BROKER_SWG_TLS_INSPECT: "true"
BROKER_SWG_TLS_INSPECT_CATEGORIES: "uncategorized,file-sharing"

How to enable

1. Requires the SWG proxy up, and for HTTPS the TLS inspection armed — it acts on the decrypted stream.
2. List the categories to block with BROKER_SWG_FILETYPE_BLOCK (e.g. executable,archive,script).
3. Catch spoofing with BROKER_SWG_FILETYPE_BLOCK_MISMATCH=true.
4. For detonation, point BROKER_SWG_SANDBOX_URL at your sandbox; tune the buffered body cap with BROKER_SWG_INSPECT_MAX_BODY.

Works with

• Secure Web Gateway & DNS filtering — file-type control runs inside the SWG inspection pipeline

Key settings

Example configuration

# Content-based file-type control on the decrypted path
BROKER_SWG_FILETYPE_BLOCK: "executable,archive"
BROKER_SWG_FILETYPE_BLOCK_MISMATCH: "true"     # block declared-vs-sniffed spoofing
BROKER_SWG_SANDBOX_URL: https://sandbox.internal/scan

How to enable

1. Set BROKER_DEM_ENABLE=true to open the /dem ingest and the admin DEM API.
2. Create monitors under Digital experience: an HTTP(S) URL or a host:port TCP target, with latency and loss thresholds.
3. For datacentre signal now, flag a monitor synthetic and set BROKER_DEM_SYNTHETIC_SECS (e.g. 60) so the broker probes it on a timer.
4. For the real per-user experience, the desktop and mobile clients probe automatically and report over their token — a no-op until monitors exist. Test one pass with pramaanctl dem.

Works with

• Identity — OIDC, SAML, SCIM & LDAP — endpoint samples are attributed to the token's subject
• ZTNA — private apps & connectors — monitors usually target internal apps reached through connectors

Key settings

Example configuration

# Digital Experience Monitoring
BROKER_DEM_ENABLE: "true"
BROKER_DEM_SYNTHETIC_SECS: "60"     # broker probes synthetic monitors every 60s (0 = off)

How to enable

1. Set BROKER_AGENTS_ENABLE=true to open the agent registry and the client-credentials grant.
2. Keep BROKER_AGENTS_REQUIRE_ENROLLED_DEVICE=true so an agent secret alone is not enough — the key must be an owner-enrolled device.
3. Turn on the tool broker with BROKER_MCP_ENABLE=true, and signed receipts with BROKER_AGENTS_PROVENANCE=true.
4. Draft agent policies in plain English with the Policy Copilot, review them, then enable.

Works with

• MFA, passkeys & device-bound tokens — agent tokens are device-bound like any other
• Transparency log & CAEP — provenance receipts anchor in the log

Key settings

Example configuration

# Identity for AI agents + the MCP tool broker
BROKER_AGENTS_ENABLE: "true"
BROKER_AGENTS_REQUIRE_ENROLLED_DEVICE: "true"  # secret alone is never enough
BROKER_MCP_ENABLE: "true"
BROKER_AGENTS_PROVENANCE: "true"               # signed action receipts

How to enable

1. Run a local OpenAI-compatible SLM server on an internal host.
2. Point BROKER_COPILOT_URL at it — it must be loopback / private / localhost, or the broker refuses to start.
3. Set BROKER_COPILOT_ENABLE=true; tune the abstention floor with BROKER_COPILOT_MIN_CONFIDENCE.
4. Optionally pin BROKER_COPILOT_MODEL_SHA256 so receipts attest a known model build.

Works with

• Transparency log & CAEP — every proposal records a reproducibility receipt
• Identity for AI agents & MCP — the copilot can author agent policies

Key settings

Example configuration

# On-prem Policy Copilot (advisory, off the hot path)
BROKER_COPILOT_ENABLE: "true"
BROKER_COPILOT_URL: http://127.0.0.1:8899        # MUST be loopback/private or the broker won't start
BROKER_COPILOT_MODEL: qwen3-1.7b-instruct-q4_k_m
BROKER_COPILOT_MIN_CONFIDENCE: "0.6"            # abstain below this

How to enable

1. Set BROKER_RUNBOOKS_ENABLE=true; with it off, the engine is a complete no-op.
2. Watch the Risk events page in the admin console — entries appear the moment a real signal (posture drop, token reuse, device non-compliance, brute-force lockout, impossible travel) occurs; never synthetic.
3. Tune the remediation per signal from the Runbook rules panel on that page; leave rules advisory, or tick auto-apply for the ones you trust.
4. Optionally add a per-signal script: it reads the read-only rb context and returns one of none, step_up, revoke_family, quarantine_device. It is compiled and sandbox-checked when you save; a script that fails or returns an unknown value falls back to the fixed action, so it can never force an unexpected remediation.
5. Scripts are rhai. Write a decision as an if/else that yields a quoted action string — e.g. if rb.device_score < 40 { "quarantine_device" } else { "step_up" }. Combine conditions with && / || (not the words and/or), compare with ==, and note rhai has no ternary ? : operator — use if/else. The editor tells you exactly what won't compile.
6. With the on-prem AI copilot on (BROKER_COPILOT_ENABLE), use Draft a script with AI to describe the logic in plain language — the model proposes a script, the broker verifies it compiles and dry-runs it over sample devices, and you review that concrete behaviour before installing. Installed scripts are advisory; the model never enables auto-apply. If a draft can't compile (say the model reached for a ternary), the broker rejects it with a clear reason rather than installing anything.
7. To let auto rules actually act, also set BROKER_RUNBOOKS_AUTO=true — without it, every rule stays advisory. Step-up never auto-applies.
8. Pair it with BROKER_REATTEST_ON_REFRESH so each refresh re-checks device posture — that keeps the tier current, so a real drop is detected promptly.

Works with

• Device posture & trust tiers — the posture-drop signal comes from the device trust tier
• Transparency log & CAEP — each advisory is recorded to the tamper-evident audit log

Key settings

How to enable

1. The log is public by design — verifiability needs open access — and served with its own permissive CORS.
2. Enable shared-signals streams with BROKER_CAEP_ENABLE=true and register receivers.
3. Anchor the receipt chain head with a post-quantum key via BROKER_SLHDSA_SECRET_FILE.
4. Verify receipts and inclusion proofs from the admin console Transparency section — the browser first checks the signed tree head's signature against the public keys, so every proof is anchored to a root the server actually signed, not one it merely claims.
5. Device revocations are attributable: the audit entry records the acting principal and the IP it came from alongside the device's owner, for both the app's DELETE /devices/{id} and the account portal's DELETE /api/devices/{id}. The actor is display-only and deliberately outside the receipt hash, so entries written before the field existed still verify.

Works with

• Identity for AI agents & MCP — agent receipts are logged and browser-verifiable

Key settings

Example configuration

# Continuous access (shared signals) + PQ receipt anchor
BROKER_CAEP_ENABLE: "true"
BROKER_SLHDSA_SECRET_FILE: /keys/slhdsa_secret.b64

How to enable

1. Install the signed package for the platform (the always-on build is packaged with the L3 feature included).
2. Sign in and enrol: pramaanctl login then pramaanctl enroll — this registers a hardware-backed device key.
3. Open the console with pramaanctl console to see device health, reach apps, manage approvals and toggle always-on.
4. Point it at your broker with PRAMAAN_BROKER (or pramaanctl config set-broker); it keeps itself current via signed auto-update.

Command-line (pramaanctl)

Client settings

Works with

• Device posture & trust tiers — the client collects and signs the eleven health signals
• Always-on access (L3 tunnel) — the always-on datapath lives here
• Digital Experience Monitoring — the client runs the per-user experience probes

Example configuration

# Point the client at your broker (or: pramaanctl config set-broker <url>)
PRAMAAN_BROKER=https://id.example.com
pramaanctl login && pramaanctl enroll
pramaanctl console        # device health, apps, approvals, always-on

How to enable

1. Install the app and sign in; then enrol the device — one biometric check generates a hardware-backed key (plus a post-quantum co-signing key).
2. Add more accounts by scanning a provisioning QR or entering an issuer and client id; each account enrols its own device key.
3. Approvals, QR sign-in and TOTP work out of the box; the broker features (offline codes, device manager, sync, experience probing) light up when the account points at a Pramaan broker.
4. On Android 14+, enable Pramaan as a passkey provider in system settings to use it as a roaming authenticator.

Works with

• MFA, passkeys & device-bound tokens — the app is the push / QR / passkey factor
• Digital Experience Monitoring — the app probes the real experience from the phone's network

Example configuration

# Add a Pramaan-broker account (unlocks the full Zero-Trust suite)
#  1. Open the app -> Add source -> scan the provisioning QR
#  2. Sign in, then enrol the device (one biometric check)
#  Broker base for the reference deployment: https://pramaanid.cloud

How to enable

1. Mount the signing key at BROKER_SIGNING_KEY_FILE so the JWKS key-ids never change across restarts.
2. Before a redeploy, tag the running image as rollback-<name>; rebuild and bring it up; roll back by re-tagging if needed.
3. After any deploy, confirm the JWKS key-ids are unchanged and /healthz returns 200.
4. Serve this documentation by setting BROKER_DOCS_DIR; it appears at /docs and is linked from the admin console.

Key settings

Example configuration

# Stable JWKS + docs + geo signals
BROKER_SIGNING_KEY_FILE: /keys/broker_es256.pem  # keep the kids stable across restarts
BROKER_DOCS_DIR: /docs-site                       # serve this documentation at /docs
GEOIP_DIR: /geoip                                 # MaxMind DBs for geo rules

Reverse proxy (nginx / Caddy)

# nginx — terminate TLS, forward to the broker (BROKER_BIND)
server {
  listen 443 ssl http2;
  server_name id.example.com;
  ssl_certificate     /etc/ssl/id.example.com.crt;
  ssl_certificate_key /etc/ssl/id.example.com.key;

  location / {
    proxy_pass         http://127.0.0.1:8080;   # BROKER_BIND
    proxy_set_header   Host              $host;
    proxy_set_header   X-Forwarded-For   $remote_addr;
    proxy_set_header   X-Forwarded-Proto https;
    proxy_http_version 1.1;                       # WebSocket upgrade (approvals)
    proxy_set_header   Upgrade    $http_upgrade;
    proxy_set_header   Connection "upgrade";
  }
}

# Caddy — same thing in two lines (automatic TLS)
# id.example.com {
#   reverse_proxy 127.0.0.1:8080
# }