{
	auto_https off
}

:3001 {
	# Reverse proxy API requests to the Symbiont runtime
	handle /api/* {
		reverse_proxy symbi:8080
	}

	# Reverse proxy WebSocket connections to the Symbiont runtime
	handle /ws/* {
		reverse_proxy symbi:8080
	}

	# Serve static files from the build output
	handle {
		root * /srv/www
		encode gzip
		try_files {path} /index.html
		file_server
	}

	# Security headers
	header {
		# Defense-in-depth against XSS: no inline/eval scripts, no plugins, no
		# framing. The app's own JS is same-origin; API/WS are same-origin via
		# the /api and /ws reverse proxies above. Google Fonts is the only
		# cross-origin asset. Inline styles are allowed (Lit/Tailwind dynamic
		# styles); script injection — the actual XSS risk — is not.
		Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'"
		X-Content-Type-Options nosniff
		X-Frame-Options DENY
		X-XSS-Protection "1; mode=block"
		Referrer-Policy strict-origin-when-cross-origin
		Permissions-Policy "camera=(), microphone=(), geolocation=()"
		-Server
	}
}
