{
	# Replace with the email address used for ACME certificate registration.
	email admin@example.com
}

# Public production endpoint.
music.example.com {
	encode zstd gzip

	reverse_proxy 127.0.0.1:4533 {
		header_up Host {host}
		header_up X-Real-IP {remote_host}
		header_up X-Forwarded-For {remote_host}
		header_up X-Forwarded-Proto {scheme}
		header_up X-Forwarded-Host {host}

		# Flush promptly for long-lived audio responses.
		flush_interval -1
	}

	header {
		X-Content-Type-Options nosniff
		Referrer-Policy same-origin
		X-Frame-Options DENY
		Permissions-Policy "camera=(), microphone=(), geolocation=()"
		Strict-Transport-Security "max-age=31536000; includeSubDomains"
	}
}

# Optional LAN-only HTTP endpoint. Use only on trusted networks.
# http://music.lan {
# 	reverse_proxy 192.168.1.20:4533
# }
