{
    auto_https off
    servers {
        max_header_size 8KB
        trusted_proxies static private_ranges
        client_ip_headers X-Forwarded-For X-Real-IP
    }
}

:80 {
    request_body {
        max_size 50GB
    }

    # ===== UNGUARDED PATHS (login/auth/logout) =====
    handle_path /auth/* {
        reverse_proxy auth:8000
    }

    handle /login {
        rewrite * /
        reverse_proxy auth:8000
    }

    handle_path /login/* {
        reverse_proxy auth:8000
    }

    handle /logout {
        reverse_proxy auth:8000/api/logout
        redir /login 302
    }

    # ===== GUARDED ROUTES =====
    # forward_auth as a route-level directive: applied to all subsequent handles
    route {
        forward_auth auth:8000 {
            uri /api/check
            header_up X-Real-IP {client_ip}
            header_up X-Forwarded-Uri {uri}
            copy_headers Cookie
        }

        handle_path /maps/* {
            root * /srv/maps
            file_server
        }
        handle_path /weather/* {
            root * /srv/weather
            file_server
        }
        handle_path /garden/* {
            root * /srv/garden
            file_server
        }

        @kiwixApi path /library/viewer* /library/content* /library/catalog* /library/skin* /library/search* /library/suggest* /library/raw* /library/ROOT*
        handle @kiwixApi {
            reverse_proxy kiwix:8080
        }

        handle_path /library-admin/* {
            reverse_proxy zim-upload:8000
        }

        handle_path /library/* {
            root * /srv/library
            file_server
            try_files {path} /index.html
        }
        handle /library {
            redir /library/ 301
        }

        @freqs path /freqs /freqs/*
        handle @freqs {
            uri strip_prefix /freqs
            reverse_proxy freqs:8000
        }

        @inventory path /inventory /inventory/*
        handle @inventory {
            uri strip_prefix /inventory
            reverse_proxy inventory:8000
        }

        @overlay path /overlay /overlay/*
        handle @overlay {
            uri strip_prefix /overlay
            reverse_proxy overlay:8000
        }

        @search path /search /search/*
        handle @search {
            uri strip_prefix /search
            reverse_proxy search:8000
        }

        handle_path /pdfs/* {
            reverse_proxy pdfs:8000
        }

        handle {
            reverse_proxy homepage:3000
        }
    }
}