api.evaldiff.io {
	# Operations aggregates are private to the deployment network.
	@operations path /ops /ops/*
	respond @operations 404

	reverse_proxy api:8000
	encode zstd gzip

	# security headers
	header {
		Strict-Transport-Security "max-age=31536000; includeSubDomains"
		X-Content-Type-Options nosniff
		-Server
	}
}

evaldiff.io {
	root * /srv/site
	file_server
	encode zstd gzip
	header {
		Strict-Transport-Security "max-age=31536000; includeSubDomains"
		X-Content-Type-Options nosniff
		-Server
	}
}
