spb/internetpressure

1# InternetPressure edge (BHS64b). Plain HTTP on :8350, published ONLY on the WireGuard address (compose.yml).2# TLS terminates on the BHS64 gateway (https://www.internetpressure.io → 10.67.0.61:8350), the trusted proxy.3{4	admin off5	auto_https off6	servers {7		trusted_proxies static 10.67.0.0/24 172.16.0.0/128	}9	log {10		output stdout11		format json12		level INFO13	}14}1516:8350 {17	encode zstd gzip1819	header {20		-Server21		X-Content-Type-Options nosniff22		X-Frame-Options SAMEORIGIN23		Referrer-Policy strict-origin-when-cross-origin24		Permissions-Policy "camera=(), microphone=(), geolocation=()"25		Strict-Transport-Security "max-age=63072000; includeSubDomains"26		defer27	}2829	# probe ingestion (signed, gzip bodies) and the public API incl. SSE (Caddy streams text/event-stream)30	@backend path /ingest/* /api/*31	handle @backend {32		reverse_proxy api:8352 {33			flush_interval -134			transport http {35				read_timeout 036				dial_timeout 5s37			}38			header_up X-Forwarded-Proto https39		}40	}4142	# everything else → Next.js43	handle {44		reverse_proxy web:8351 {45			header_up X-Forwarded-Proto https46		}47	}48}49