{
	email {$ACME_EMAIL}
}

(security_headers) {
	header {
		Strict-Transport-Security "max-age=31536000; includeSubDomains"
		X-Content-Type-Options "nosniff"
		X-Frame-Options "SAMEORIGIN"
		Referrer-Policy "strict-origin-when-cross-origin"
		-Server
	}
}

{$PUBLIC_DOMAIN} {
	import security_headers
	encode zstd gzip

	# /admin and /uploads go to Strapi; everything else to the frontend.
	# Strapi 5 nests the whole admin panel (UI + its own API) under /admin,
	# so this single prefix is enough - it never touches /api, which stays
	# reserved for the frontend's own Nitro endpoints.
	@cms path /admin* /uploads*
	handle @cms {
		# Uploaded media can be large; Strapi's own limit still applies.
		request_body {
			max_size 100MB
		}
		reverse_proxy cms:1337
	}

	handle {
		reverse_proxy frontend:3000
	}
}