{
    auto_https disable_redirects
    admin off
}

:80 {
    @music_health {
        host musicserver.internal.invalid
        path /health /health/db
    }
    handle @music_health {
        reverse_proxy 10.71.100.83:18080
    }
    @reports {
        host reports.secret-studio.ru reports001.secret-studio.ru
    }
    handle @reports {
        redir https://{host}{uri} 308
    }
    @access {
        host access.secret-studio.ru
    }
    handle @access {
        redir https://access.secret-studio.ru{uri} 308
    }
    handle {
        respond "not found" 404
    }
}

https://reports.secret-studio.ru {
    log {
        output stderr
        format json
    }

    @crawl_root path /
    handle @crawl_root {
        header Cache-Control "no-cache, max-age=0, must-revalidate"
        header X-Robots-Tag "index, follow"
        root * /srv/wg-paid/web-meta
        rewrite * /index.html
        file_server
    }

    @robots path /robots.txt
    handle @robots {
        header Cache-Control "no-cache, max-age=0, must-revalidate"
        root * /srv/wg-paid/web-meta
        file_server
    }

    @sitemap path /sitemap.xml
    handle @sitemap {
        header Cache-Control "no-cache, max-age=0, must-revalidate"
        root * /srv/wg-paid/web-meta
        rewrite * /sitemap-reports.xml
        file_server
    }

    handle {
        @latest path /latest /latest/*
        header @latest Cache-Control "no-cache, max-age=0, must-revalidate"
        @old path /old /old/*
        header @old Cache-Control "public, max-age=31536000, immutable"
        header X-Robots-Tag "index, follow"
        root * /srv/wg-paid/reports
        file_server
    }
}

https://reports001.secret-studio.ru {
    log {
        output stderr
        format json
    }

    @crawl_root path /
    handle @crawl_root {
        header Cache-Control "no-cache, max-age=0, must-revalidate"
        header X-Robots-Tag "index, follow"
        root * /srv/wg-paid/web-meta
        rewrite * /index.html
        file_server
    }

    @robots path /robots.txt
    handle @robots {
        header Cache-Control "no-cache, max-age=0, must-revalidate"
        root * /srv/wg-paid/web-meta
        file_server
    }

    @sitemap path /sitemap.xml
    handle @sitemap {
        header Cache-Control "no-cache, max-age=0, must-revalidate"
        root * /srv/wg-paid/web-meta
        rewrite * /sitemap-reports001.xml
        file_server
    }

    handle {
        @latest path /latest /latest/*
        header @latest Cache-Control "no-cache, max-age=0, must-revalidate"
        @old path /old /old/*
        header @old Cache-Control "public, max-age=31536000, immutable"
        header X-Robots-Tag "index, follow"
        root * /srv/wg-paid/reports
        file_server
    }
}

https://access.secret-studio.ru {
    header {
        Cache-Control "no-store, max-age=0"
        Pragma "no-cache"
        Referrer-Policy "no-referrer"
        X-Content-Type-Options "nosniff"
        X-Frame-Options "DENY"
        Content-Security-Policy "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; connect-src 'self'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'"
    }

    @health path /health
    handle @health {
        respond "access-ok" 200
    }

    @root path /
    handle @root {
        respond 204
    }

    @login path /login /login/
    handle @login {
        root * /srv/wg-paid/access-web
        rewrite * /login.html
        file_server
    }

    @magic path /auth/magic /auth/magic/
    handle @magic {
        root * /srv/wg-paid/access-web
        rewrite * /magic.html
        file_server
    }

    @public_api path /v2/auth/login/request /v2/auth/magic-link/consume /v2/auth/invites/redeem /v2/auth/logout /v2/account/me /v2/account/profiles /v2/account/profiles/*
    handle @public_api {
        reverse_proxy 10.71.100.83:18080
    }

    handle {
        respond "not found" 404
    }
}
