{
	email {$ACME_EMAIL}
}

(security_headers) {
	header {
		Strict-Transport-Security "max-age=31536000; includeSubDomains"
		X-Content-Type-Options "nosniff"
		X-Frame-Options "SAMEORIGIN"
		Referrer-Policy "strict-origin-when-cross-origin"
		-Server
	}
}

{$PUBLIC_DOMAIN} {
	import security_headers
	encode zstd gzip

	# Strapi mounts each of its (and its plugins') admin APIs at its own
	# top-level path, not all under /admin - the admin panel's dashboard
	# widgets, media library, i18n, etc each call their own plugin prefix.
	# This list is every @strapi/* package in cms/package.json plus the
	# core-bundled plugins (content-manager, content-type-builder, upload,
	# i18n, email, content-releases, review-workflows). Adding a new Strapi
	# plugin later means adding its prefix here too.
	# None of this touches /api, reserved for the frontend's own Nitro
	# endpoints.
	@cms path /admin* /content-manager* /content-type-builder* /upload*\
		/i18n* /email* /content-releases* /review-workflows*\
		/users-permissions* /cloud*
	handle @cms {
		# Uploaded media can be large; Strapi's own limit still applies.
		request_body {
			max_size 100MB
		}
		reverse_proxy cms:1337
	}

	handle {
		reverse_proxy frontend:3000
	}
}