:{$PORT:80} {
    root * /srv
    encode gzip zstd

    # Security Headers
    header {
        X-Content-Type-Options "nosniff"
        X-Frame-Options "DENY"
        X-XSS-Protection "1; mode=block"
        Referrer-Policy "strict-origin-when-cross-origin"
    }

    # Static Asset Caching
    @assets path /assets/*
    header @assets Cache-Control "public, max-age=31536000, immutable"

    # API & Healthcheck Reverse Proxy to Backend
    handle /health {
        reverse_proxy {$BACKEND_URL:backend:8000}
    }

    handle /api/* {
        reverse_proxy {$BACKEND_URL:backend:8000} {
            header_up Host {upstream_hostport}
            header_up X-Real-IP {remote_host}
            header_up X-Forwarded-For {remote_host}
            header_up X-Forwarded-Proto {scheme}
        }
    }

    # SPA Fallback & Static File Server
    handle {
        try_files {path} /index.html
        file_server
    }
}