{
	email {$ACME_EMAIL}
	admin localhost:2019
}

{$POSTEANDO_DOMAIN} {
	# Keep operational access logs without OAuth query strings or session headers.
	log {
		format filter {
			wrap json
			fields {
				request>uri delete
				request>headers delete
				resp_headers delete
			}
		}
	}
	encode zstd gzip
	request_body {
		max_size 135MB
	}
	header {
		X-Content-Type-Options nosniff
		Referrer-Policy strict-origin-when-cross-origin
		-Server
	}
	@tiktokVerification path /tiktok2uzL7KVlGsVi5jrEmAY9d9NY8XhufT5I.txt /tiktok2woAb5lEdIMkiv4GopH4WWX4vAG7wx7v.txt
	handle @tiktokVerification {
		root * /srv/posteando-public
		header Content-Type "text/plain; charset=utf-8"
		file_server
	}
	@legal path /privacy /privacy/* /terms /terms/* /legal.css /posteando-icon.svg /producto /producto/* /ayuda /ayuda/* /canales /canales/* /contacto /contacto/* /licencia /licencia/* /product.css /fonts/* /img/* /posteando-source.tar.gz
	handle @legal {
		root * /srv/posteando-public
		header {
			Content-Security-Policy "default-src 'none'; style-src 'self'; img-src 'self'; font-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'"
			Cache-Control "public, max-age=300"
			X-Robots-Tag "noindex, nofollow"
		}
		file_server
	}
	# Subscribers' own assistants connect over MCP with OAuth. Clients look for
	# the endpoint and its RFC 9728/8414 metadata at the domain root, while the
	# backend is served under /api.
	@mcp path /mcp-oauth-dynamic /.well-known/oauth-protected-resource/mcp-oauth-dynamic /.well-known/oauth-authorization-server/mcp-oauth-dynamic
	handle @mcp {
		rewrite * /api{uri}
		reverse_proxy app:5000
	}
	handle {
		reverse_proxy app:5000
	}
}

# Public entry: the product, help, channels, contact, license and legal pages.
# Everything else (sign in, sign up, API, OAuth callbacks) stays on the app domain.
{$POSTEANDO_PUBLIC_DOMAIN:posteando.app}, www.{$POSTEANDO_PUBLIC_DOMAIN:posteando.app} {
	log {
		format filter {
			wrap json
			fields {
				request>uri delete
				request>headers delete
				resp_headers delete
			}
		}
	}
	encode zstd gzip
	header {
		X-Content-Type-Options nosniff
		Referrer-Policy strict-origin-when-cross-origin
		-Server
	}
	@www host www.{$POSTEANDO_PUBLIC_DOMAIN:posteando.app}
	redir @www https://{$POSTEANDO_PUBLIC_DOMAIN:posteando.app}{uri} permanent
	@root path /
	redir @root /producto/
	@site path /privacy /privacy/* /terms /terms/* /legal.css /posteando-icon.svg /producto /producto/* /ayuda /ayuda/* /canales /canales/* /contacto /contacto/* /licencia /licencia/* /product.css /fonts/* /img/*
	handle @site {
		root * /srv/posteando-public
		header {
			Content-Security-Policy "default-src 'none'; style-src 'self'; img-src 'self'; font-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'"
			Cache-Control "public, max-age=300"
			X-Robots-Tag "noindex, nofollow"
		}
		file_server
	}
	handle {
		redir https://{$POSTEANDO_DOMAIN}{uri}
	}
}
