{
    default_sni {$SURROUNDCORE_UI_IP:127.0.0.1}
    auto_https disable_redirects
}

http://:80 {
    redir https://{host}{uri} 308
}

https://{$SURROUNDCORE_UI_HOST:core.local}, https://{$SURROUNDCORE_UI_IP:127.0.0.1} {
    # Keep LAN HTTPS off Tailscale's private Serve address on the same host.
    bind {$SURROUNDCORE_UI_IP:127.0.0.1}
    tls internal
    encode zstd gzip
    @root path /
    redir @root /core/ 307
    reverse_proxy {$SURROUNDCORE_UPSTREAM:127.0.0.1:18086} {
        header_up X-Forwarded-For {remote_host}
        header_up X-Forwarded-Host {hostport}
    }
    header {
        X-Content-Type-Options "nosniff"
        X-Frame-Options "SAMEORIGIN"
        Referrer-Policy "same-origin"
    }
}
