{
    frankenphp
    order php_server before file_server
}

:80 {
    root * /app/public

    header {
        X-Frame-Options "DENY"
        X-Content-Type-Options "nosniff"
        Referrer-Policy "strict-origin-when-cross-origin"
        Permissions-Policy "camera=(), microphone=(), geolocation=()"
        -Server
    }

    # Assets Symfony (webpack encore)
    handle /bundles/* {
        file_server
    }

    # Service worker (must be served from root scope)
    handle /sw.js {
        file_server
    }

    # API → Symfony front controller
    handle /api/* {
        php_server
    }

    # SPA React : try static files first, fallback to index.html
    handle {
        try_files {path} /index.html
        file_server
    }

    encode gzip
}