(common) {
	root * /srv
	encode gzip

	header {
		X-Content-Type-Options "nosniff"
		X-Frame-Options "DENY"
		Referrer-Policy "no-referrer"
		Permissions-Policy "geolocation=(), microphone=(), camera=()"
		Content-Security-Policy "default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self'; form-action 'none'; frame-ancestors 'none'; base-uri 'none'"
	}

	@shorturl path_regexp short ^/s/([a-zA-Z0-9]+)$
	rewrite @shorturl /s.php?c={re.short.1}

	php_fastcgi 127.0.0.1:9000
	file_server
}

# Clearnet (auto-HTTPS)
{$DOMAIN:localhost} {
	import common
	header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
}

# Tor hidden service (HTTP only, no TLS needed)
:8080 {
	import common
}