{
  email {$ACME_EMAIL}
  admin off
}

{$SITE_DOMAIN} {
  encode zstd gzip

  @admin path /admin/*
  handle @admin {
    basic_auth {
      {$ADMIN_BASIC_USER} {$ADMIN_BASIC_PASSWORD_HASH}
    }
    reverse_proxy web:4321
  }

  @adminApi path /api/v1/admin/*
  handle @adminApi {
    basic_auth {
      {$ADMIN_BASIC_USER} {$ADMIN_BASIC_PASSWORD_HASH}
    }
    reverse_proxy api:8000
  }

  @api path /api/* /health /ready
  handle @api {
    reverse_proxy api:8000
  }

  handle {
    reverse_proxy web:4321
  }

  header {
    -Server
    Strict-Transport-Security "max-age=31536000; includeSubDomains"
    X-Content-Type-Options "nosniff"
    Referrer-Policy "strict-origin-when-cross-origin"
    Permissions-Policy "camera=(), microphone=(), geolocation=()"
    X-Frame-Options "DENY"
    Cross-Origin-Opener-Policy "same-origin"
    Content-Security-Policy "frame-ancestors 'none'; base-uri 'self'; object-src 'none'"
  }
}

{$FILES_DOMAIN} {
  encode zstd gzip
  reverse_proxy minio:9000
  header {
    -Server
    Strict-Transport-Security "max-age=31536000; includeSubDomains"
    X-Content-Type-Options "nosniff"
    Referrer-Policy "no-referrer"
    X-Frame-Options "DENY"
    Content-Security-Policy "default-src 'none'; img-src 'self' data:; style-src 'unsafe-inline'; sandbox"
  }
}