{
	servers {
		metrics
	}
	admin 0.0.0.0:2019
}

(security_headers) {
	header {
		Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
		X-Content-Type-Options "nosniff"
		X-Frame-Options "DENY"
		Referrer-Policy "strict-origin-when-cross-origin"
		Permissions-Policy "camera=(), microphone=(), geolocation=()"
		Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' blob:; worker-src 'self' blob:; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://*.tile.openstreetmap.org; connect-src 'self' wss: https://*.sentry.io https://*.ingest.de.sentry.io; font-src 'self';"
	}
}

(block_scanners) {
	@scanners path /.env* /.git* /wp-* /wp-admin* /admin* /config.* /backup* /.aws* /.docker* /composer* /vendor* *.php *.asp
	respond @scanners 403
}

{$DOMAIN:trails.cool} {
	import security_headers
	import block_scanners
	log {
		output stdout
		format json
	}
	reverse_proxy journal:3000
}

www.{$DOMAIN:trails.cool} {
	redir https://{$DOMAIN:trails.cool}{uri} permanent
}

grafana.internal.{$DOMAIN:trails.cool} {
	reverse_proxy grafana:3000
}

planner.{$DOMAIN:trails.cool} {
	import security_headers
	import block_scanners
	log {
		output stdout
		format json
	}
	reverse_proxy planner:3001
}