{{ ansible_managed | comment }}

{{ hedgedoc_domain }} {
    encode gzip

    header {
        # enable HSTS
        Strict-Transport-Security "max-age=31536000; preload;"

        # disable clients from sniffing the media type
        X-Content-Type-Options nosniff

        # clickjacking protection
        X-Frame-Options DENY

        # keep referrer data off of HTTP connections
        Referrer-Policy no-referrer-when-downgrade

        # Server name removing
        -Server
    }

    reverse_proxy hedgedoc:3000
}