# Serves dist/ on Railway's $PORT. Fingerprinted CSS and JS are cached for a year,
# media for a week, and the page itself is always revalidated. The site lives at
# https://playhorizon.dev: Railway's own *.up.railway.app address redirects there, so the
# page is indexed once. Railway's healthcheck (Host: healthcheck.railway.app) is still served.
{
	admin off
	auto_https off
	persist_config off
}

:{$PORT:8080} {
	root * /srv

	@railway header_regexp Host ^[^.]+\.up\.railway\.app(:[0-9]+)?$
	redir @railway https://playhorizon.dev{uri} permanent
	encode zstd gzip

	header {
		X-Content-Type-Options nosniff
		Referrer-Policy strict-origin-when-cross-origin
		X-Frame-Options DENY
		Permissions-Policy "interest-cohort=(), browsing-topics=(), camera=(), microphone=(), geolocation=()"
		Content-Security-Policy "default-src 'self'; script-src 'self' {$CSP_SCRIPT}; style-src 'self' {$CSP_STYLE}; img-src 'self' data: https://avatars.githubusercontent.com; font-src 'self'; connect-src 'self' https://api.github.com https://raw.githubusercontent.com; frame-ancestors 'none'; base-uri 'self'; form-action 'self'"
		-Server
	}
	@assets path /assets/*
	header @assets Cache-Control "public, max-age=31536000, immutable"
	@media path /media/* /fonts/* /og.png /favicon* /apple-touch-icon.png
	header @media Cache-Control "public, max-age=604800"
	rewrite /privacy /privacy.html
	@pages path / /index.html /404.html /privacy.html
	header @pages Cache-Control "no-cache"
	@legal path /LEGAL.md /fonts/*.txt
	header @legal Content-Type "text/plain; charset=utf-8"

	file_server {
		hide .csp-script .csp-style og.html
	}
	handle_errors {
		rewrite * /404.html
		file_server
	}
}