{
	acme_dns cloudflare {env.CLOUDFLARE_API_TOKEN}
}

netbird.archfox.org {
	@grpc header Content-Type application/grpc*
	reverse_proxy @grpc h2c://10.0.1.47:80
	@backend path /relay* /ws-proxy/* /api/* /oauth2/*
	reverse_proxy @backend 10.0.1.47:80
	reverse_proxy /* 10.0.1.47:80
}

matrix.archfox.org {
	reverse_proxy continuwuity:6167
}

pyke.archfox.org {
	reverse_proxy redbot:8969
}

actual.archfox.org {
	reverse_proxy actual:5006
}

searxng.archfox.org {
	reverse_proxy searxng:8080
}

git.archfox.org {
	reverse_proxy gitea:3000 {
		flush_interval -1
	}
}

jelly.archfox.org {
	reverse_proxy jellyfin:8096
}

vault.archfox.org {
	reverse_proxy vaultwarden:80 {
		flush_interval -1
	}
}

aria.archfox.org {
	reverse_proxy ariang:8080 {
		flush_interval -1
	}
}

nextcloud.archfox.org {
	reverse_proxy 10.0.1.45:11000 {
		flush_interval -1
		transport http {
			versions 1.1
			read_buffer 64KB
			write_buffer 64KB
		}
	}
}

bookstack.archfox.org {
	reverse_proxy bookstack:80
}

panel.archfox.org {
	reverse_proxy tpanel:80 {
		flush_interval -1
	}

	php_fastcgi unix//run/php/php8.3-fpm.sock {
		root /var/www/pterodactyl/public
		index index.php

		env PHP_VALUE "upload_max_filesize = 100M
		post_max_size = 100M"
		env HTTP_PROXY ""
		env HTTPS "on"

		read_timeout 300s
		dial_timeout 300s
		write_timeout 300s
	}

	header Strict-Transport-Security "max-age=16768000; preload;"
	header X-Content-Type-Options "nosniff"
	header X-XSS-Protection "1; mode=block;"
	header X-Robots-Tag "none"
	header Content-Security-Policy "frame-ancestors 'self'"
	header X-Frame-Options "DENY"
	header Referrer-Policy "same-origin"
	header Access-Control-Allow-Origin "*"
	header Access-Control-Allow-Methods "GET, POST, OPTIONS"
	header Access-Control-Allow-Headers "Authorization, Content-Type"

	request_body {
		max_size 100g
	}

	respond /.ht* 403
}

wings.archfox.org {
	reverse_proxy twings:443 {
		flush_interval -1
	}
}

omada.archfox.org {
	reverse_proxy host.docker.internal:8043 {
		transport http {
			tls_insecure_skip_verify
		}
		header_up Host "omada.archfox.org:443"
	}
}

ai.archfox.org {
	reverse_proxy open-webui:8080
}

p.archfox.org {
	reverse_proxy pastefy:80
}

archfox.org {
	root * /srv
	file_server

	@webfinger {
		path /.well-known/webfinger
		method GET HEAD
		query resource=acct:poslop@archfox.org
		query resource=mailto:poslop@archfox.org
		query resource=https://archfox.org
		query resource=https://archfox.org/
	}
	rewrite @webfinger /webfinger.json
	header @webfinger {
		Content-Type "application/jrd+json"
		Access-Control-Allow-Origin "*"
		X-Robots-Tag "noindex"
	}
}

(global) {
	header {
		# disable FLoC tracking
		Permissions-Policy interest-cohort=()

		# enable HSTS
		Strict-Transport-Security max-age=31536000;

		# keep referrer data off
		Referrer-Policy no-referrer

		# prevent for appearing in search engine for private instances (option)
		#X-Robots-Tag noindex
	}
}