{
	persist_config off

	log {
		output stderr
		level WARN
		exclude http.auto_https
		format console {
			time_key ""
		}
	}

	metrics {
		per_host
	}

	storage s3 {
		host "{env.S3_ENDPOINT}"
		access_id "{env.S3_ACCESS_KEY_ID}"
		secret_key "{env.S3_SECRET_ACCESS_KEY}"
		bucket "{env.S3_BUCKET}"
		prefix "ssl"
	}

	email {env.ACME_EMAIL}

	auto_https disable_redirects

	on_demand_tls {
		permission http http://localhost:3001
	}

	servers :80 {
		name http
		protocols h1 h2c
	}

	servers :443 {
		name https
		protocols h1 h2
	}

	servers :2002 {
		name health
		protocols h1
	}
}

(backend_pages) {
	@h2c `{env.FEATURES}.matches(r"\bh2c\b")`
	reverse_proxy @h2c h2c://{$GIT_PAGES_ADDRESS:localhost}:3000
	reverse_proxy http://{$GIT_PAGES_ADDRESS:localhost}:3000
}

http:// {
	@get method GET
	redir @get https://{host}{uri} 301

	# initial PUT/POST for a new domain has to happen over HTTP
	import backend_pages
}

https:// {
	tls {
		on_demand
	}

	encode
	import backend_pages
}

http://localhost:2002 {
	reverse_proxy http://localhost:3002
}