spb/internetpressure

1# InternetPressure edge (BHS64b). Plain HTTP on :8350, published ONLY on the WireGuard address (compose.yml).2# TLS terminates on the BHS64 gateway (https://www.internetpressure.io → 10.67.0.61:8350), the trusted proxy.3{4	admin off5	auto_https off6	servers {7		trusted_proxies static 10.67.0.0/24 172.16.0.0/128	}9	log {10		output stdout11		format json12		level INFO13	}14}1516:8350 {17	header {18		-Server19		X-Content-Type-Options nosniff20		X-Frame-Options SAMEORIGIN21		Referrer-Policy strict-origin-when-cross-origin22		Permissions-Policy "camera=(), microphone=(), geolocation=()"23		Strict-Transport-Security "max-age=63072000; includeSubDomains"24		defer25	}2627	# Server-Sent Events: never compressed or buffered28	@live path /api/v1/live29	handle @live {30		reverse_proxy api:8352 {31			flush_interval -132			transport http {33				read_timeout 034				dial_timeout 5s35			}36			header_up X-Forwarded-Proto https37		}38	}3940	# probe ingestion (signed, gzip bodies) and the public API41	@backend path /ingest/* /api/*42	handle @backend {43		encode zstd gzip44		reverse_proxy api:8352 {45			transport http {46				dial_timeout 5s47			}48			header_up X-Forwarded-Proto https49		}50	}5152	# everything else → Next.js53	handle {54		encode zstd gzip55		reverse_proxy web:8351 {56			header_up X-Forwarded-Proto https57		}58	}59}60