# Copyright 2024 ff, Scalytics, Inc. - https://www.scalytics.io
# SPDX-License-Identifier: Apache-2.0

{
	admin off
}

{$KAFSIEM_SITE_ADDRESS::80} {
	root * /srv
	encode zstd gzip

	header {
		Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; style-src-elem 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' data: blob: https://tiles.openfreemap.org; font-src 'self' data: https://fonts.gstatic.com; connect-src 'self' https://tiles.openfreemap.org; worker-src 'self' blob:; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self'"
		Access-Control-Allow-Origin "*"
		Access-Control-Allow-Methods "GET, POST, OPTIONS"
		Access-Control-Allow-Headers "Content-Type, Authorization, X-Requested-With"
		Access-Control-Expose-Headers "Content-Length, Content-Type"
		Vary "Origin"
		Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
		Permissions-Policy "camera=(), geolocation=(), microphone=()"
		Referrer-Policy "strict-origin-when-cross-origin"
		X-Content-Type-Options "nosniff"
		X-Frame-Options "DENY"
	}

	@preflight method OPTIONS
	respond @preflight 204

	handle /api/* {
		reverse_proxy kafsiem-api:8081 {
			header_up Authorization "Bearer {$API_BEARER_TOKEN:}"
		}
	}

	handle /alerts.json {
		route {
			root * /var/lib/kafsiem
			file_server {
				pass_thru
			}
			root * /srv
			file_server
		}
	}

	handle /incidents.json {
		route {
			root * /var/lib/kafsiem
			file_server {
				pass_thru
			}
			root * /srv
			file_server
		}
	}

	handle /alerts-filtered.json {
		route {
			root * /var/lib/kafsiem
			file_server {
				pass_thru
			}
			root * /srv
			file_server
		}
	}

	handle /alerts-state.json {
		route {
			root * /var/lib/kafsiem
			file_server {
				pass_thru
			}
			root * /srv
			file_server
		}
	}

	handle /source-health.json {
		route {
			root * /var/lib/kafsiem
			file_server {
				pass_thru
			}
			root * /srv
			file_server
		}
	}

	handle /zone-briefings.json {
		route {
			root * /var/lib/kafsiem
			file_server {
				pass_thru
			}
			root * /srv
			file_server
		}
	}

	handle /ucdp-current-conflicts.json {
		route {
			root * /var/lib/kafsiem
			file_server {
				pass_thru
			}
			root * /srv
			file_server
		}
	}

	handle /ucdp-conflict-stats.json {
		route {
			root * /var/lib/kafsiem
			file_server {
				pass_thru
			}
			root * /srv
			file_server
		}
	}

	@runtime_geo path /geo/conflict-zones*.geojson /geo/conflict-footprints*.geojson /geo/terrorism-zones*.geojson
	handle @runtime_geo {
		route {
			root * /var/lib/kafsiem
			file_server {
				pass_thru
			}
			root * /srv
			file_server
		}
	}

	handle /views-risk.json {
		route {
			root * /var/lib/kafsiem
			file_server {
				pass_thru
			}
			root * /srv
			file_server
		}
	}

	handle /geo/views-risk-grid.json {
		route {
			root * /var/lib/kafsiem
			file_server {
				pass_thru
			}
			root * /srv
			file_server
		}
	}

	@mobile_bare path /m
	redir @mobile_bare /m/ permanent

	handle /m/* {
		uri strip_prefix /m
		root * /srv
		try_files {path} /mobile/index.html
		file_server
	}

	handle {
		try_files {path} /index.html
		file_server
	}
}
