{$DOMAIN} {
  reverse_proxy web:3000 {
    header_up Host {host}
    header_up X-Real-IP {remote_host}
    header_up X-Forwarded-For {remote_host}
    header_up X-Forwarded-Proto {scheme}
  }

  # Compression
  encode gzip

  # Security headers
  header X-Content-Type-Options nosniff
  header X-Frame-Options SAMEORIGIN
  header X-XSS-Protection "1; mode=block"
  header Referrer-Policy strict-origin-when-cross-origin
}

# MinIO console (optional - remove in production for security)
# minio.{$DOMAIN} {
#   reverse_proxy minio:9001
# }