{
	http_port 80
}

# API subdomain — прокси на backend + MinIO (HTTP, SSL на Synology)
http://api.{$DOMAIN} {
	handle_path /files/* {
		reverse_proxy minio:9000 {
			header_up Host {host}
			header_up X-Real-IP {remote}
		}
	}

	reverse_proxy backend:8080 {
		header_up Host {host}
		header_up X-Real-IP {remote}
		header_up X-Forwarded-Proto {scheme}
	}

	header {
		X-Content-Type-Options "nosniff"
		X-Frame-Options "DENY"
		Referrer-Policy "strict-origin-when-cross-origin"
		Permissions-Policy "geolocation=(self), microphone=(), camera=()"
	}
}

# Frontend main domain
http://{$DOMAIN} {
	reverse_proxy frontend:3000 {
		header_up Host {host}
		header_up X-Real-IP {remote}
	}

	header {
		X-Content-Type-Options "nosniff"
		X-Frame-Options "DENY"
		Referrer-Policy "strict-origin-when-cross-origin"
		Permissions-Policy "geolocation=(self), microphone=(), camera=()"
		Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://*.basemaps.cartocdn.com https://api.{$DOMAIN}; font-src 'self' data:; connect-src 'self' wss://api.{$DOMAIN} https://api.{$DOMAIN}; frame-ancestors 'none';"
	}

	@static {
		path /_next/static/*
		path /static/*
		path /images/*
		path /favicon.ico
	}
	header @static Cache-Control "public, max-age=31536000, immutable"

	encode zstd gzip
}