# Replace your-domain.com with your actual domain
{$DOMAIN} {
	import snippets/Logging

	# Traffic Analytics service
	import snippets/TrafficAnalytics

	# ActivityPub Service
	import snippets/ActivityPub

	# Default proxy everything else to Ghost
	handle {
		reverse_proxy ghost:2368
	}

	# Optional: Enable gzip compression
	encode gzip

	# Optional: Add security headers
	header {
		# Enable HSTS
		Strict-Transport-Security max-age=31536000;
		# Prevent embedding in frames
		X-Frame-Options DENY
		# Enable XSS protection
		X-XSS-Protection "1; mode=block"
		# Prevent MIME sniffing
		X-Content-Type-Options nosniff
		# Referrer policy
		Referrer-Policy strict-origin-when-cross-origin
	}
}

# Redirect www to non-www (optional)
www.{$DOMAIN} {
	import snippets/Logging
	redir https://{$DOMAIN}{uri}
}