{
    # No TLS is terminated here, so disable HTTPS redirects/certs and the admin API
    auto_https off
    admin off
}

:8080 {
    encode gzip

    # WebSocket SSH endpoint (keep full path)
    handle /ws* {
        reverse_proxy 127.0.0.1:8081
    }

    # HTTP API endpoints (preserve /api/* path)
    handle /api/* {
        # Reject oversized uploads before they reach the backend
        request_body {
            max_size {$MAX_UPLOAD_SIZE:100MB}
        }
        reverse_proxy 127.0.0.1:8082
    }

    # Static files and SPA fallback
    route {
        root * /srv
        try_files {path} /index.html
        file_server
    }
}