{
    admin off
}

{$PUBLIC_DOMAIN} {
    header X-Content-Type-Options nosniff
    header Referrer-Policy same-origin
    # All UI, /api and /v1 pass through Astra origin/privacy enforcement.
    reverse_proxy web:8080 {
        # SSE text/event-stream is auto-flushed; avoid negative flush cancellation semantics.
        flush_interval 0s
        lb_try_duration 0s
        transport http {
            dial_timeout 10s
        }
    }
    # No Authorization/body logging. Align timeout budgets in whole-chain acceptance.
}
