{
	email {$ACME_EMAIL}
	admin off
}

{$DOMAIN} {
	encode zstd gzip
	header {
		Strict-Transport-Security "max-age=31536000"
		X-Content-Type-Options nosniff
		Referrer-Policy same-origin
		-Server
	}
	# Backend serves web/ and authenticated media; never expose /data directly.
	# No access log: URLs can contain private search terms or media filenames.
	reverse_proxy app:8000
}
