{$DOMAIN} {
    encode zstd gzip

    # SvelteKit frontend — static assets with long-lived cache (content-hashed filenames)
    @hashed_assets path_regexp hashed /_app/immutable/.*\.[a-f0-9]{8,}\.(js|css|woff2)$
    header @hashed_assets Cache-Control "public, max-age=31536000, immutable"

    # API — never cache
    @api path /api/*
    header @api Cache-Control "no-store"

    # Media is served by the authenticated gateway at /media/{kind}/{id}, which
    # sets its own Cache-Control (private) and security headers per response — no
    # Caddy-side cache rules (the old /media/previews|originals matchers were for
    # the retired static mount).

    # Route API and media requests to the Rust backend. Set X-Real-IP from the
    # real TCP peer and overwrite any client-supplied value so the backend's
    # rate-limit keys can't be spoofed via a forged X-Forwarded-For.
    reverse_proxy /api/* app:3000 {
        header_up X-Real-IP {remote_host}
    }
    reverse_proxy /media/* app:3000 {
        header_up X-Real-IP {remote_host}
    }

    # Everything else goes to SvelteKit frontend
    reverse_proxy frontend:3001
}