snackpdf.com {
  redir https://www.snackpdf.com{uri} permanent
}

www.snackpdf.com {
  root * /srv/snackpdf
  encode zstd gzip

  @write_methods not method GET HEAD
  respond @write_methods "Method not allowed" 405

  @wasm path *.wasm
  header @wasm Content-Type application/wasm

  header {
    Cache-Control "public, max-age=0, must-revalidate"
    Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' blob: data:; font-src 'self'; connect-src 'self'; worker-src 'self'; object-src 'none'; frame-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'"
    X-Content-Type-Options "nosniff"
    Referrer-Policy "no-referrer"
    Permissions-Policy "accelerometer=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()"
    Strict-Transport-Security "max-age=31536000; includeSubDomains"
    Cross-Origin-Opener-Policy "same-origin"
    Cross-Origin-Resource-Policy "same-origin"
  }

  @service_worker path /service-worker.js
  header @service_worker Cache-Control "no-cache, no-store, must-revalidate"
  header @service_worker Service-Worker-Allowed "/"

  @hashed_assets path /assets/*
  header @hashed_assets Cache-Control "public, max-age=31536000, immutable"

  @engine_assets path /engine/*
  header @engine_assets Cache-Control "public, max-age=0, must-revalidate"

  try_files {path} {path}/index.html =404
  file_server
}
