:8443 {
    tls /run/secrets/omega_tls_cert /run/secrets/omega_tls_key
    encode zstd gzip

    @health path /healthz /readyz
    reverse_proxy omega-walls:8080 {
        header_up X-Forwarded-Proto https
        header_up X-Forwarded-Host {host}
        header_up X-Real-IP {remote_host}
    }

    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains"
        X-Content-Type-Options "nosniff"
        X-Frame-Options "DENY"
        Referrer-Policy "no-referrer"
    }
}
