{
    servers {
        trusted_proxies static 173.245.48.0/20 103.21.244.0/22 103.22.200.0/22 103.31.4.0/22 141.101.64.0/18 108.162.192.0/18 190.93.240.0/20 188.114.96.0/20 197.234.240.0/22 198.41.128.0/17 162.158.0.0/15 104.16.0.0/13 104.24.0.0/14 172.64.0.0/13 131.0.72.0/22 2400:cb00::/32 2606:4700::/32 2803:f800::/32 2405:b500::/32 2405:8100::/32 2a06:98c0::/29 2c0f:f248::/32
        timeouts {
            read_body   10s
            read_header 10s
            # must exceed the API's 75s WriteTimeout (main.go), which itself exceeds the 60s docs/diff handler timeout
            write        90s
            idle         90s
        }
    }
}

{$DOMAIN:localhost} {
    tls internal

    encode gzip zstd

    header {
        X-Content-Type-Options nosniff
        Referrer-Policy strict-origin-when-cross-origin
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        # script-src must allow static.cloudflareinsights.com: Cloudflare
        # auto-injects the Web Analytics beacon, and without this the browser
        # blocks it — which logged a CSP error on every page load AND meant Web
        # Analytics recorded nothing at all.
        #
        # The host is allowed rather than Cloudflare's documented
        # `.../beacon.min.js`, because auto-injection serves the script from a
        # versioned sub-path (`/beacon.min.js/v4513...`). CSP source paths that
        # do not end in "/" are matched exactly, so the documented value does
        # not match the URL Cloudflare actually injects — verified in Chrome.
        #
        # connect-src stays 'self' for the beacon: under auto-injection it
        # reports to this origin, so it needs no third-party connect entry.
        #
        # EthicalAds needs both its hosts in script-src: the client script
        # (media.ethicalads.io) and the ad-decision API (server.ethicalads.io).
        # The client requests each ad as JSONP, i.e. a <script> tag, never
        # fetch/XHR, so connect-src does not apply to it. Creatives and view
        # pixels are <img> tags, covered by the existing img-src https:.
        Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://static.cloudflareinsights.com https://media.ethicalads.io https://server.ethicalads.io; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self'; font-src 'self' data:; frame-ancestors 'self' https://buildhop.io https://www.buildhop.io"
        # Isolate this browsing context group from cross-origin openers. Safe
        # here: the app opens no popups and holds no cross-origin window
        # handles — every external link is target="_blank" rel="noopener".
        Cross-Origin-Opener-Policy "same-origin"
        -Server
    }

    handle /api {
        reverse_proxy api:8080
    }

    handle /api/* {
        reverse_proxy api:8080
    }

    handle /llms.txt {
        reverse_proxy api:8080
    }

    handle {
        reverse_proxy web:3000
    }
}