{
	admin 127.0.0.1:2019
	servers {
		protocols h1 h2
	}
}

bbs.outsoftware.it, retrobbs.sinclair.homepc.it {
	root * /home/outsoft/outsoftware-web-bbs/site
	encode zstd gzip

	header {
		X-Content-Type-Options nosniff
		Referrer-Policy no-referrer
		X-Frame-Options DENY
		Permissions-Policy "camera=(), microphone=(), geolocation=()"
		Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self' wss://bbs.outsoftware.it wss://retrobbs.sinclair.homepc.it; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'"
	}

	header /guest-capability.json >Cache-Control "no-store"

	@guest_capability {
		method GET
		expression `{http.request.uri} == "/guest-capability.json"`
	}
	handle @guest_capability {
		reverse_proxy 127.0.0.1:6080 {
			@broker_unavailable status 502 503
			handle_response @broker_unavailable {
				rewrite * /guest-capability.json
				file_server {
					status 200
				}
			}
		}
	}

	@bbs_websocket path /ws /ws/guest
	handle @bbs_websocket {
		@wrong_origin not {
			header Origin https://bbs.outsoftware.it
			header Origin https://retrobbs.sinclair.homepc.it
		}
		@upgrade header Upgrade websocket
		route {
			respond @wrong_origin "Forbidden" 403
			reverse_proxy @upgrade 127.0.0.1:6080
			respond "WebSocket upgrade required" 426
		}
	}

	handle {
		file_server
	}

	handle_errors 502 503 {
		@guest_capability_unavailable {
			method GET
			expression `{http.request.uri} == "/guest-capability.json"`
		}
		handle @guest_capability_unavailable {
			header Cache-Control "no-store"
			rewrite * /guest-capability.json
			file_server {
				status 200
			}
		}
		handle {
			respond "" {err.status_code}
		}
	}
}
