{
	email {$ACME_EMAIL}
}

{$WEB_PUBLIC_HOST} {
	encode zstd gzip

	basic_auth {
		{$WEB_BASIC_AUTH_USER} {$WEB_BASIC_AUTH_PASSWORD_HASH}
	}

	header {
		Strict-Transport-Security "max-age=31536000; includeSubDomains"
		X-Content-Type-Options "nosniff"
		X-Frame-Options "DENY"
		Referrer-Policy "no-referrer"
		Permissions-Policy "camera=(), geolocation=(), microphone=()"
		-Server
	}

	reverse_proxy web:8765
}

{$MCP_PUBLIC_HOST} {
	header {
		Strict-Transport-Security "max-age=31536000; includeSubDomains"
		X-Content-Type-Options "nosniff"
		X-Frame-Options "DENY"
		Referrer-Policy "no-referrer"
		-Server
	}

	reverse_proxy mcp:8890
}