:80 {
	root * /srv
	encode gzip

	header {
		X-Content-Type-Options nosniff
		X-Frame-Options DENY
		Referrer-Policy strict-origin-when-cross-origin
	}

	# A missing hashed asset is a 404, never the app shell cached for a year
	handle /assets/* {
		@exists file
		header @exists Cache-Control "public, max-age=31536000, immutable"
		file_server
	}

	# Revalidate the shell so a deploy's new asset hashes are picked up
	handle {
		header Cache-Control "no-cache"
		try_files {path} /index.html
		file_server
	}
}
