# Replace play.example.com and C:\MudClient with your real web address and install path.
play.example.com {
	root * C:\MudClient\web\wwwroot
	encode gzip zstd
	header {
		Content-Security-Policy "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; connect-src 'self' wss:; img-src 'self' https: data:; font-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'none'"
		Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()"
		Referrer-Policy "no-referrer"
		Strict-Transport-Security "max-age=31536000"
		X-Content-Type-Options "nosniff"
		X-Frame-Options "DENY"
	}

	handle /ws {
		reverse_proxy 127.0.0.1:5000
	}

	# Keep the Blazor fallback separate from /ws. Otherwise a non-upgrade
	# request for /ws can be rewritten to index.html before it reaches the proxy.
	handle {
		try_files {path} {path}/ /index.html
		file_server
	}
}
