{$WAVES_DOMAIN:mixes.subterra.fi} {
	# Metrics remain available to local monitoring, not the public subdomain.
	@private path /metrics /metrics/*
	respond @private 404

	header {
		X-Content-Type-Options nosniff
		Referrer-Policy strict-origin-when-cross-origin
	}

	# Preserve Range/If-Range and upstream 206 responses for audio seeking.
	# No response buffering or full-file caching is enabled here.
	reverse_proxy waves-server:8080
}
