(proxy) {
	listener_wrappers {
		proxy_protocol {
			timeout 1s
			allow {$ALLOW_PROXY}
		}
		tls
	}
}

{
	storage s3 {
		host "{env.PAGES_STORAGE_S3_ENDPOINT}"
		access_id "{env.PAGES_STORAGE_S3_ACCESS_KEY_ID}"
		secret_key "{env.PAGES_STORAGE_S3_SECRET_ACCESS_KEY}"
		bucket "{env.PAGES_STORAGE_S3_BUCKET}"
		prefix "ssl"
	}

	admin off

	persist_config off

	log {
		output stderr
		level WARN
		exclude admin http.auto_https
		format console {
			time_key ""
		}
	}

	metrics

	email {env.ACME_EMAIL}

	auto_https disable_redirects

	on_demand_tls {
		permission http http://localhost:3001
	}

	servers :80 {
		name http
		protocols h1 h2c
		import proxy
	}

	servers :443 {
		name https
		protocols h1 h2
		import proxy
	}

	servers {$UDP_BIND_TO:0.0.0.0}:443 {
		name http3
		protocols h3
	}

	servers :2002 {
		name health
		protocols h1
	}

	servers :2019 {
		name metrics
		protocols h1
	}
}

(backend) {
	tls {
		on_demand
	}

	@h2c `{env.PAGES_FEATURES}.matches(r"\bh2c\b")`
	reverse_proxy @h2c h2c://{$GIT_PAGES_ADDRESS:localhost}:3000
	reverse_proxy http://{$GIT_PAGES_ADDRESS:localhost}:3000

	header Alt-Svc `h3=":443"; persist=1, h2=":443"; persist=1`
	encode
}

http:// {
	# initial PUT/POST for a new domain has to happen over HTTP
	@get method GET
	redir @get https://{host}{uri} 301

	import backend
}

https:// {
	import backend
}

https:// {
	# Fly.io requires UDP sockets to be bound to a different IP
	bind {$UDP_BIND_TO:0.0.0.0}

	import backend
}

http://localhost:2002 {
	reverse_proxy http://localhost:3002
}

http://:2019 {
	metrics
}