{
    auto_https off
    admin off
    https_port {$EXPOSE_PORT:8785}

    servers :{$EXPOSE_PORT:8785} {
        protocols h1 h2 h3
    }
}

https://{$APP_DOMAIN:localhost}:{$EXPOSE_PORT:8785} {
    tls /certs/server.crt /certs/server.key

    encode gzip zstd

    request_body {
        max_size 25MB
    }

    header {
        -Server
        -Via
        X-Content-Type-Options "nosniff"
        X-Frame-Options "SAMEORIGIN"
        Referrer-Policy "strict-origin-when-cross-origin"
        Permissions-Policy "geolocation=(), microphone=(), camera=()"
        Strict-Transport-Security "max-age=31536000"
    }

    reverse_proxy web:5000
}