(auth) {
	basicauth {
		admin $2a$14$DahHUWD2cKyXJ96sH5VQwuQv1bqmIn0gsdoSaw4mofzfdNY2Y0VsO
	}
}

(common) {
	encode gzip zstd
	header {
		Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
		X-Content-Type-Options "nosniff"
		X-Frame-Options "DENY"
		Referrer-Policy "strict-origin-when-cross-origin"
		Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=()"
		Cross-Origin-Opener-Policy "same-origin"
		Cross-Origin-Resource-Policy "same-origin"
		Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:"
	}

	# Blockera kända skadliga sökvägar för alla domäner
	@blocked path_regexp ^/(\.env|\.git(/.*)?|\.well-known/acme-challenge/.*\.php|wp-login.*|wp-admin(/.*)?|wp-includes(/.*)?|wp-content(/.*)?|xmlrpc\.php|xmrlpc\.php|api/graphql|actuator/env|\.DS_Store|cgi-bin(/.*)?|vendor/|telescope|debug|info\.php|config\.json|[a-zA-Z0-9_-]{1,12}\.php|class-.*\.php|whs.*\.php|wp-.*\.php)$
	respond @blocked 403

	# Blockera kända botar
	@blocked_bots header_regexp User-Agent (scanhawk|leakix|CensysInspect|l9scan|sqlmap|Nikto|DirBuster|OpenAI-SearchBot|oai-searchbot|GitFinder|RootEvidence|zgrab|masscan|nuclei)
	respond @blocked_bots 403

	# Svara på robots.txt istället för 403
	@robots path /robots.txt
	respond @robots "User-agent: *\nDisallow: /" 200
}

test.gynther.se {
	import auth
	import common
	# Samma Flutter-anpassade CSP som recept.gynther.se
	header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' https://www.gstatic.com; connect-src 'self' https://www.gstatic.com https://fonts.gstatic.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob:"
	reverse_proxy recipe-flutter:5000
}

nzbget.gynther.se {
	import common
	reverse_proxy http://192.168.50.4:6789
}

prowlarr.gynther.se {
	import common
	reverse_proxy http://prowlarr:9696
}

radarr.gynther.se {
	import common
	reverse_proxy http://radarr:7878
}

sonarr.gynther.se {
	import common
	reverse_proxy http://sonarr:8989
}

jellyfin.gynther.se {
	import common
	reverse_proxy http://jellyfin:8096
}

qbittorrent.gynther.se {
	import common
	reverse_proxy 192.168.50.4:8080
}

wetty.gynther.se {
	import auth
	import common
	redir / /wetty
	reverse_proxy wetty:3003
}

gitea.gynther.se {
	import common
	reverse_proxy 192.168.50.2:3002
}

# ============================================
# Import Service (Document Converter) - Standalone UI
# ============================================
import.gynther.se {
	import common

	# Lägg till en standard-sida för /
	handle / {
		respond "Welcome to Import Service" 200
	}

	reverse_proxy importer-api:3001
}

# ============================================
# RECIPE APP + IMPORT SERVICE
# ============================================
recept.gynther.se {
	import common

	# Flutter Web (CanvasKit) kräver script/wasm/fonter från gstatic.com.
	# Skriver över den strikta CSP:n från (common).
	header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' https://www.gstatic.com; connect-src 'self' https://www.gstatic.com https://fonts.gstatic.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob:"

	# === IMPORT SERVICE (Document Converter) ===
	# Dessa endpoints måste komma FÖRST innan backend reglerna!
	handle /api/recipes/import* {
		reverse_proxy importer-api:3001
	}

	# === RECIPE FRONTEND PROXY ENDPOINTS ===
	# Next.js API routes
	handle /api/inventory-history-proxy {
		reverse_proxy recipe-flutter:5000
	}

	handle /api/admin/merge-preview-proxy {
		reverse_proxy recipe-flutter:5000
	}

	handle /api/recipe-preview-proxy {
		reverse_proxy recipe-flutter:5000
	}

	# === RECIPE BACKEND API ENDPOINTS ===
	# Backend körs på port 8080 (från docker-compose)
	handle /api/products* {
		reverse_proxy recipe-api:8080
	}

	handle /api/inventory* {
		reverse_proxy recipe-api:8080
	}

	handle /api/recipes* {
		reverse_proxy recipe-api:8080
	}

	# === HEALTH CHECKS ===
	handle /health {
		reverse_proxy recipe-api:8080
	}

	# === CATCH ALL ===
	# Övriga /api/* går till frontend
	handle /api/* {
		reverse_proxy recipe-flutter:5000
	}

	# Frontend - catch all remaining routes (port 5000)
	reverse_proxy /* recipe-flutter:5000
}