whisper.money.local {
	# Use mkcert certificates (generated by setup script)
	# These certificates are automatically trusted by browsers
	tls /etc/caddy/certs/whisper.money.local.pem /etc/caddy/certs/whisper.money.local-key.pem

	reverse_proxy host.docker.internal:8000

	header {
		-Server
		X-Content-Type-Options "nosniff"
		X-Frame-Options "DENY"
		X-XSS-Protection "1; mode=block"
	}

	encode zstd gzip
}