# Rendered by terraform/edge. Do not edit on the instance.
#
# Caddy terminates TLS for the .cn hostnames and forwards over the WireGuard
# tunnel to ingress-nginx. flush_interval -1 disables response buffering so
# Server-Sent Events reach the client chunk-by-chunk.
{
	email ${acme_email}
	admin off
}

${hosts} {
	reverse_proxy ${ingress_upstream} {
		flush_interval -1
	}

	header {
		Strict-Transport-Security "max-age=31536000; includeSubDomains"
		X-Content-Type-Options "nosniff"
		X-Frame-Options "DENY"
		Referrer-Policy "strict-origin-when-cross-origin"
	}
}