localhost {
    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains"
        X-Frame-Options "DENY"
        X-Content-Type-Options "nosniff"
    }
    handle /uploads/* {
        root * /srv
        file_server
    }
    reverse_proxy app:3000
}