{
    # Browsers usually omit SNI for IP URLs; Docker's local IP is different.
    default_sni {$PUBLIC_IP}
}

https://{$PUBLIC_IP} {
    tls {
        issuer acme https://acme-v02.api.letsencrypt.org/directory {
            profile shortlived
        }
    }

    encode zstd gzip
    header X-Content-Type-Options nosniff
    header Referrer-Policy same-origin

    redir /wolin /wolin/ 308
    redir /blackjack /blackjack/ 308

    handle_path /wolin/* {
        header Cache-Control "no-store"
        header X-Frame-Options DENY
        reverse_proxy web:8004 {
            header_up -Authorization
            transport http {
                response_header_timeout 150s
            }
        }
    }

    handle {
        @hidden path /.env* /.git/* /.vite/* /vinext-client-entry-manifest.json /_headers /.assetsignore
        respond @hidden 404
        root * /srv
        file_server
    }
}