{
	servers {
		trusted_proxies static {$FLUXER_EDGE_TRUSTED_PROXIES:private_ranges}
		trusted_proxies_strict
	}
	default_sni 143.20.50.74
	auto_https disable_redirects
	{$FLUXER_EDGE_GLOBAL_OPTIONS}
}

{$FLUXER_EDGE_SITE_ADDRESS}, web.kordyx.xyz {
    tls {
        issuer acme {
            dir https://acme-v02.api.letsencrypt.org/directory
            profile shortlived
            disable_http_challenge
        }
    }
	encode {$FLUXER_EDGE_ENCODE:zstd gzip}
	header Link "</source/>; rel=\"license\""
	redir /source /source/ 308
	handle_path /source/* {
		root * /srv/source
		file_server
	}

	redir /downloads /downloads/ 308
	redir /download https://kordyx.xyz/download/ 302
	handle_path /downloads/* {
        @installers path /Kordia-Android-arm64.apk /Kordia-Android-armv7.apk /Kordia-Android-x86_64.apk /SHA256SUMS /kordyx-background.png /kordyx-transparent.png
        handle @installers {
            root * /srv/downloads
            file_server
        }
        handle {
            respond "Not found" 404
        }
	}
	handle_path /updates/* {
		root * /srv/updates
		header Cache-Control "no-cache"
		file_server
	}

	handle_path /branding/* {
		root * /srv/branding
		header Cache-Control "no-cache"
		file_server
	}

	@kordiaAvatars path /avatars/0.png /avatars/1.png /avatars/2.png /avatars/3.png /avatars/4.png /avatars/5.png
	handle @kordiaAvatars {
		root * /srv/branding
		header Cache-Control "no-cache"
		file_server
	}

	@kordiaWebIcons path /web/favicon.ico /web/favicon-16x16.png /web/favicon-32x32.png /web/apple-touch-icon.png /web/android-chrome-192x192.png /web/android-chrome-512x512.png /web/mstile-150x150.png
	handle @kordiaWebIcons {
		root * /srv/branding
		header Cache-Control "no-cache"
		file_server
	}

	handle /_health {
		respond "OK" 200
	}

	handle_path /api/* {
		reverse_proxy api:8080
	}

	handle /gateway {
		rewrite * /
		reverse_proxy gateway:8080
	}

	handle_path /gateway/* {
		reverse_proxy gateway:8080
	}

	handle_path /media/* {
		reverse_proxy media-proxy:8080
	}

	handle_path /livekit/* {
		reverse_proxy livekit:7880
	}

	@canonicalAdmin {
		host web.kordyx.xyz
		path /admin /admin/*
	}
	handle @canonicalAdmin {
		redir https://143.20.50.74{uri} 308
	}

	handle {$FLUXER_ADMIN_BASE_PATH:/admin} {
		rewrite * /
		reverse_proxy admin:8080
	}

	handle_path {$FLUXER_ADMIN_BASE_PATH:/admin}/* {
		reverse_proxy admin:8080
	}

	@staticAssets path /web/* /emoji/* /libs/* /avatars/* /badges/* /desktop/*
	handle @staticAssets {
		reverse_proxy static-proxy:8080
	}

	handle /.well-known/assetlinks.json {
		rewrite * /assetlinks.json
		root * /srv/branding
		header Cache-Control "public, max-age=3600"
		file_server
	}

	handle /.well-known/kordyx {
		rewrite * /.well-known/fluxer
		reverse_proxy api:8080
	}

	handle /.well-known/fluxer {
		reverse_proxy api:8080
	}

	handle {
		reverse_proxy app-proxy:8080
	}
}

:8088 {
	handle /.well-known/fluxer {
		reverse_proxy api:8080
	}
}

:8080 {
	redir https://143.20.50.74{uri} 308
}

# Kordyx institutional site. Existing IP app and port 80 services remain intact.
kordyx.xyz {
    tls {
        issuer acme {
            dir https://acme-v02.api.letsencrypt.org/directory
            disable_http_challenge
        }
    }
    encode zstd gzip
    header Link "<https://web.kordyx.xyz/source/>; rel=\"license\""
    header X-Content-Type-Options nosniff
    header Referrer-Policy strict-origin-when-cross-origin
    header Content-Security-Policy "default-src 'self'; img-src 'self'; style-src 'self'; font-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"
    @appRoutes path /login /register /forgot /recover /recover-account /channels/* /invite/*
    redir @appRoutes https://web.kordyx.xyz{uri} 308
    redir /plutonium /premium 308
    redir /blog/how-i-built-fluxer /blog/how-i-built-kordyx 308
    redir /status https://status.kordyx.xyz/ 302
    redir /status/ https://status.kordyx.xyz/ 302
    redir /downloads https://downloads.kordyx.xyz/ 302
    redir /downloads/* https://downloads.kordyx.xyz{uri} 302
    handle {
        root * /srv/kordyx-website
        file_server
    }
    handle_errors {
        @notFound expression {http.error.status_code} == 404
        handle @notFound {
            root * /srv/kordyx-website
            rewrite * /404.html
            file_server
        }
    }
}

# Kordyx documentation: prerendered output of the native Astro/Starlight project.
docs.kordyx.xyz {
    tls {
        issuer acme {
            dir https://acme-v02.api.letsencrypt.org/directory
            disable_http_challenge
        }
    }
    encode zstd gzip
    header X-Content-Type-Options nosniff
    header Referrer-Policy strict-origin-when-cross-origin
    header X-Frame-Options DENY
    header Link "<https://web.kordyx.xyz/source/>; rel=\"license\""
    @docsHealth path /_health
    respond @docsHealth "OK" 200
    @upstreamInstallers path /install.sh /install.sh.sha256 /install.ps1 /install.ps1.sha256
    respond @upstreamInstallers "Instaladores próprios Kordyx não disponíveis. Consulte os guias." 404
    root * /srv/kordyx-docs
    file_server
}
