# Example only: adapt the host, certificate, and upstream policy to your deployment.
# This snippet assumes a static site with no executable client-side JavaScript.

example.test {
	root * /srv/example-site
	encode zstd gzip

	header {
		-Server
		Content-Security-Policy "default-src 'self'; base-uri 'self'; form-action 'none'; frame-ancestors 'none'; object-src 'none'; script-src 'none'; style-src 'self'; img-src 'self' data:"
		Permissions-Policy "accelerometer=(), camera=(), geolocation=(), microphone=(), payment=(), usb=()"
		Referrer-Policy "strict-origin-when-cross-origin"
		Strict-Transport-Security "max-age=31536000; includeSubDomains"
		X-Content-Type-Options "nosniff"
		X-Frame-Options "DENY"
	}

	file_server
}