{$SITE_DOMAIN} {
	encode zstd gzip

	# Internal metrics/health detail must not be public.
	respond /internal/* 404

	header {
		Strict-Transport-Security "max-age=31536000"
		X-Content-Type-Options "nosniff"
		Referrer-Policy "strict-origin-when-cross-origin"
		Content-Security-Policy "default-src 'self'; img-src 'self' https://cdn.discordapp.com data:; connect-src 'self' wss://{$SITE_DOMAIN}; style-src 'self' 'unsafe-inline'; font-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'"
		-Server
	}

	# The app serves the built web assets with long-lived caching for /assets/* and no-cache for index.html.
	reverse_proxy app:3000
}