:80 {
    root * /srv
    encode gzip

    # Browsers ignore Strict-Transport-Security on a plain-HTTP connection,
    # so this is a no-op today and becomes effective the moment TLS is
    # terminated in front of this service (host-level Caddy once a domain
    # is chosen — see this repo's docker-compose.yml comment on core's
    # equivalent line).
    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        X-Content-Type-Options "nosniff"
        X-Frame-Options "DENY"
        Referrer-Policy "strict-origin-when-cross-origin"
        Permissions-Policy "camera=(), microphone=(), geolocation=()"
        -Server
    }

    try_files {path} /index.html

    # sw.js/registerSW.js are fixed filenames (not content-hashed like the
    # rest of the build), so they must always be revalidated — otherwise a
    # browser that already cached sw.js never asks for a newer one and the
    # PWA freezes on whatever version was installed the first time.
    @swfiles {
        path /sw.js /registerSW.js
    }
    header @swfiles Cache-Control "no-cache"

    @static {
        path *.js *.css *.png *.jpg *.svg *.ico *.woff2 *.woff
        not path /sw.js /registerSW.js
    }
    header @static Cache-Control "public, max-age=31536000, immutable"

    file_server
}
