{
  email tony@zephior.com
  admin localhost:2019
}

(secure_headers) {
  header {
    Strict-Transport-Security "max-age=15552000; includeSubDomains"
    X-Content-Type-Options nosniff
    X-Frame-Options SAMEORIGIN
    Referrer-Policy no-referrer
    Permissions-Policy "camera=(), microphone=(), geolocation=()"
    X-Robots-Tag "noindex, nofollow, noarchive"
    -Server
    -X-Powered-By
  }
}

(application) {
  import secure_headers
  encode zstd gzip
  @unsafe path /api/auth/test-* /api/qa/* /api/retool/* /monitoring* /ingest/*
  respond @unsafe "Not found" 404
  request_body {
    max_size 150MB
  }
}

compliance.zephior.com {
  import application
  handle /source.tar.gz {
    root * /opt/compai/source
    file_server
  }
  handle {
    reverse_proxy 127.0.0.1:3000
  }
}

api.compliance.zephior.com {
  import application
  header Cache-Control no-store
  @unsupported path /v1/trust-access/* /v1/security-penetration-tests* /v1/background-checks* /v1/billing/webhook /api/auth/admin/* /v1/admin/*
  respond @unsupported "This service is not enabled on this deployment." 404
  reverse_proxy 127.0.0.1:3333
}

employee.compliance.zephior.com {
  import application
  reverse_proxy 127.0.0.1:3002
}

files.compliance.zephior.com {
  import secure_headers
  header {
    -X-Frame-Options
    Content-Security-Policy "sandbox allow-downloads; default-src 'none'; frame-ancestors https://compliance.zephior.com https://employee.compliance.zephior.com"
  }
  @allowedOrigin header_regexp Origin ^https://(employee\.)?compliance\.zephior\.com$
  header @allowedOrigin {
    Access-Control-Allow-Origin "{http.request.header.Origin}"
    Access-Control-Allow-Methods "GET, HEAD, PUT, POST, DELETE, OPTIONS"
    Access-Control-Allow-Headers "content-type, x-amz-checksum-crc32, x-amz-sdk-checksum-algorithm, x-amz-meta-original-name"
    Access-Control-Expose-Headers "ETag"
    Vary Origin
  }
  @preflight method OPTIONS
  respond @preflight 204
  request_body {
    max_size 150MB
  }
  reverse_proxy 127.0.0.1:3900 {
    header_up -Cookie
    header_down -Access-Control-Allow-Origin
    header_down -Access-Control-Allow-Credentials
  }
}
