# InternetPressure edge (BHS64b). Plain HTTP on :8350, published ONLY on the WireGuard address (compose.yml).
# TLS terminates on the BHS64 gateway (https://www.internetpressure.io → 10.67.0.61:8350), the trusted proxy.
{
	admin off
	auto_https off
	servers {
		trusted_proxies static 10.67.0.0/24 172.16.0.0/12
	}
	log {
		output stdout
		format json
		level INFO
	}
}

:8350 {
	header {
		-Server
		X-Content-Type-Options nosniff
		X-Frame-Options SAMEORIGIN
		Referrer-Policy strict-origin-when-cross-origin
		Permissions-Policy "camera=(), microphone=(), geolocation=()"
		Strict-Transport-Security "max-age=63072000; includeSubDomains"
		defer
	}

	# Server-Sent Events: never compressed or buffered
	@live path /api/v1/live
	handle @live {
		reverse_proxy api:8352 {
			flush_interval -1
			transport http {
				read_timeout 0
				dial_timeout 5s
			}
			header_up X-Forwarded-Proto https
		}
	}

	# probe ingestion (signed, gzip bodies) and the public API
	@backend path /ingest/* /api/*
	handle @backend {
		encode zstd gzip
		reverse_proxy api:8352 {
			transport http {
				dial_timeout 5s
			}
			header_up X-Forwarded-Proto https
		}
	}

	# everything else → Next.js
	handle {
		encode zstd gzip
		reverse_proxy web:8351 {
			header_up X-Forwarded-Proto https
		}
	}
}