{
    admin localhost:2019
}

{$SITE_DOMAIN} {
    encode zstd gzip
    header {
        X-Content-Type-Options nosniff
        Referrer-Policy same-origin
    }
    log {
        output stdout
        format json
    }
    route {
        basic_auth {
            {$BASIC_AUTH_USER} {$BASIC_AUTH_HASH}
        }
        # Authenticate at the edge, then do not forward its password to apps.
        request_header -Authorization
        redir /php /php/ 308
        handle /api/* {
            reverse_proxy node:3000
        }
        handle_path /strip/* {
            reverse_proxy node:3000
        }
        @nodeUI path /node /node/* /events
        handle @nodeUI {
            reverse_proxy node:3000
        }
        handle_path /php/* {
            root * /srv/php/public
            php_fastcgi php:9000
            file_server
        }
        handle {
            root * /srv
            file_server
        }
    }
}

# Internal health endpoint: this port is not published by Compose.
http://:8081 {
    respond /health "ok"
}
