{
	admin off
	auto_https off
}

:{$LISTEN_PORT} {
	# 1. nur erlaubte Netze (localhost, LAN, NetBird) – siehe ALLOWED_NETS in .env
	@blocked not remote_ip {$ALLOWED_NETS}
	respond @blocked "forbidden" 403

	# 2. API-Key als Bearer-Token
	@noauth not header Authorization "Bearer {$LLM_API_KEY}"
	respond @noauth "unauthorized" 401

	# 3. an llama-swap; flush_interval -1 = Streaming (SSE) sofort durchreichen
	reverse_proxy 127.0.0.1:{$BACKEND_PORT} {
		flush_interval -1
		transport http {
			read_timeout 30m
		}
	}
}