{
  admin off
  log {
    output discard
  }
  default_sni xx.yy
  servers :443 {
    protocols h1 h2
  }
}

xx.yy {
  encode {
    gzip 6
  }
  tls {
    protocols tls1.3
    curves x25519
    alpn h2
  }

  @host {
    host xx.yy
  }
  route @host {
    header {
      Alt-Svc "h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000"
      Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
      X-Content-Type-Options nosniff
      X-Frame-Options SAMEORIGIN
      Referrer-Policy no-referrer-when-downgrade
    }
    file_server {
      root /data/fileserver
      browse
      hide .git
    }
  }
}