# global options
{
	admin off
	persist_config off
	auto_https off

	log {
		format json
	}

	servers {
		trusted_proxies static private_ranges 100.0.0.0/8 # trust railway's proxy
	}
}

:{$PORT:80} {
	log {
		format json
	}

	respond /health 200

	header {
		# Enable cross-site filter (XSS) and tell browsers to block detected attacks
		X-XSS-Protection "1; mode=block"
		# Prevent some browsers from MIME-sniffing a response away from the declared Content-Type
		X-Content-Type-Options "nosniff"
		# Keep referrer data off of HTTP connections
		Referrer-Policy "strict-origin-when-cross-origin"
		# Enable strict Content Security Policy
		Content-Security-Policy "default-src 'self'; img-src 'self' data: https: *; style-src 'self' 'unsafe-inline' https: *; script-src 'self' 'unsafe-inline' https: *; font-src 'self' data: https: *; connect-src 'self' https: *; media-src 'self' https: *; object-src 'none'; frame-src 'self' https: *;"
		# Remove Server header
		-Server
	}

	root * {{.DIST_DIR}}

	encode {
		gzip
		zstd
	}

	file_server {
		hide .git
		hide .env*
	}

	redir /install.sh https://raw.githubusercontent.com/railwayapp/railpack/refs/heads/main/install.sh 301

	file_server

	try_files {path} {path}.html {path}/index.html /index.html
}
