# Security response headers on every site (issue #119, checklist item 33).
# Nothing embeds the site, so framing is refused; HSTS has no includeSubDomains
# because the subdomains are listed one by one.
(security_headers) {
    header {
        Strict-Transport-Security "max-age=31536000"
        X-Content-Type-Options "nosniff"
        Referrer-Policy "strict-origin-when-cross-origin"
        X-Frame-Options "DENY"
        Content-Security-Policy "frame-ancestors 'none'"
        Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()"
        -Server
        -X-Powered-By
    }
}

{$SITE_ADDRESS:https://jyotisha.chat} {
    import security_headers
    encode zstd gzip

    @htmlDocuments path / /login
    header @htmlDocuments Cache-Control "private, no-store, must-revalidate"

    reverse_proxy web:3000 {
        lb_try_duration 10s
        lb_try_interval 250ms
    }
}

www.jyotisha.chat {
    import security_headers
    redir https://jyotisha.chat{uri} permanent
}