{
	email {$ACME_EMAIL}
}

http://{$AUTH_DOMAIN} {
	redir https://{host}{uri} permanent
}

http://{$LAUNCHER_DOMAIN} {
	redir https://{host}{uri} permanent
}

http://{$TASK_DOMAIN} {
	redir https://{host}{uri} permanent
}

http://{$BIM_DOMAIN} {
	redir https://{host}{uri} permanent
}

{$AUTH_DOMAIN} {
	header {
		Strict-Transport-Security "max-age=31536000; includeSubDomains"
	}

	@auth_root path /
	redir @auth_root https://{$LAUNCHER_DOMAIN}/ 302

	@auth_user_dashboard path /if/user /if/user/*
	redir @auth_user_dashboard https://{$LAUNCHER_DOMAIN}/ 302

	reverse_proxy authentik-server:9000 {
		header_up Host {host}
		header_up X-Forwarded-Proto {scheme}
		header_up X-Forwarded-For {remote_host}
	}
}

{$LAUNCHER_DOMAIN} {
	header {
		Strict-Transport-Security "max-age=31536000; includeSubDomains"
	}

	reverse_proxy {$STAGING_LAUNCHER_UPSTREAM} {
		header_up Host {host}
		header_up X-Forwarded-Proto {scheme}
		header_up X-Forwarded-For {remote_host}
	}
}

{$TASK_DOMAIN} {
	header {
		Strict-Transport-Security "max-age=31536000; includeSubDomains"
	}

	reverse_proxy {$STAGING_TASK_MANAGER_UPSTREAM} {
		header_up Host {host}
		header_up X-Forwarded-Proto {scheme}
		header_up X-Forwarded-For {remote_host}
	}
}

{$BIM_DOMAIN} {
	header {
		Strict-Transport-Security "max-age=31536000; includeSubDomains"
	}

	reverse_proxy {$STAGING_BIM_VIEWER_UPSTREAM} {
		header_up Host {host}
		header_up X-Forwarded-Proto {scheme}
		header_up X-Forwarded-For {remote_host}
	}
}
