{
  email {$ACME_EMAIL}
  admin off
}

{$SITE_DOMAIN} {
  encode zstd gzip

  @admin path /admin/*
  handle @admin {
    basic_auth {
      {$ADMIN_BASIC_USER} {$ADMIN_BASIC_PASSWORD_HASH}
    }
    reverse_proxy web:4321
  }

  @api path /api/* /health /ready
  handle @api {
    reverse_proxy api:8000
  }

  handle {
    reverse_proxy web:4321
  }

  header {
    -Server
    Strict-Transport-Security "max-age=31536000; includeSubDomains"
    X-Content-Type-Options "nosniff"
    Referrer-Policy "strict-origin-when-cross-origin"
    Permissions-Policy "camera=(), microphone=(), geolocation=()"
  }
}

{$FILES_DOMAIN} {
  encode zstd gzip
  reverse_proxy minio:9000
  header {
    -Server
    Strict-Transport-Security "max-age=31536000; includeSubDomains"
    X-Content-Type-Options "nosniff"
    Referrer-Policy "no-referrer"
  }
}