{
  auto_https off
  admin off
}

:5000 {
  root * /app/dist

  encode gzip

  log {
    output stdout
    format console {
      time_format iso8601
      level_format color
    }
    level "INFO"
  }

  header {
    X-Frame-Options "SAMEORIGIN"
    X-XSS-Protection "1;mode=block"
    Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate"
    X-Content-Type-Options "nosniff"
    Strict-Transport-Security "max-age=31536000"
    Content-Security-Policy "
      base-uri 'self';
      connect-src 'self' {$VITE_BACKEND_SERVER};
      default-src 'self' data:;
      font-src 'self' https://fonts.gstatic.com/ https://cdn.jsdelivr.net/;
      frame-src 'self';
      img-src 'self' data: https://gravatar.com/;
      manifest-src 'self';
      media-src 'self';
      object-src 'none';
      script-src 'unsafe-inline' 'report-sample' 'self' https://*.cloudfront.net;
      style-src 'report-sample' 'self' https://cdn.jsdelivr.net/ https://fonts.googleapis.com 'sha256-+OsIn6RhyCZCUkkvtHxFtP0kU3CGdGeLjDd9Fzqdl3o=';
      worker-src 'none';
    "
    Referrer-Policy "same-origin"
  }

  handle /env.js {
    header Content-Type "text/javascript"
    respond `window.config = {"VITE_BACKEND_SERVER":"{$VITE_BACKEND_SERVER}","VITE_BUILD":"{$VITE_BUILD}"};`
  }

  handle /favicon.ico {
    file_server
  }

  file_server

  handle_errors {
    @404 {
      expression {http.error.status_code} == 404
    }
    rewrite @404 /
    file_server
  }
}