{
	email {$ACME_EMAIL}
}

{$DOWNLOAD_HOST} {
	encode zstd gzip
	root * /srv/download
	redir /windows /windows/latest 302
	redir /android /android/latest 302
	redir /windows/latest /latest/windows/index.html 302
	redir /android/latest /latest/android/index.html 302
	redir /latest /latest/version.json 302
	header {
		Content-Security-Policy "default-src 'none'; frame-ancestors 'none'; base-uri 'none'"
		Cross-Origin-Resource-Policy "same-origin"
		Permissions-Policy "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()"
		Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
		X-Content-Type-Options "nosniff"
		X-Frame-Options "DENY"
		Referrer-Policy "strict-origin-when-cross-origin"
		X-Robots-Tag "noindex, nofollow"
	}
	file_server
}

{$WEBAPP_HOST:vstalk.phy.kr} {
	encode zstd gzip
	header {
		Content-Security-Policy "default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self'; connect-src 'self' https: wss:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"
		Cross-Origin-Opener-Policy "same-origin"
		Cross-Origin-Resource-Policy "same-origin"
		Permissions-Policy "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()"
		Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
		X-Content-Type-Options "nosniff"
		X-Frame-Options "DENY"
		Referrer-Policy "strict-origin-when-cross-origin"
	}
	handle /v1/* {
		reverse_proxy api:8080
	}
	handle /health {
		reverse_proxy api:8080
	}
	handle {
		reverse_proxy webapp:80
	}
}

{$API_HOST} {
	encode zstd gzip
	header {
		Content-Security-Policy "default-src 'none'; frame-ancestors 'none'; base-uri 'none'"
		Cross-Origin-Resource-Policy "same-origin"
		Permissions-Policy "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()"
		Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
		X-Content-Type-Options "nosniff"
		Referrer-Policy "strict-origin-when-cross-origin"
	}
	reverse_proxy api:8080
}