{{ www_host }} {
	# PocketBase Admin UI and REST API (files included)
	redir /_ /_/
	handle /_/* {
		reverse_proxy {{ docker_container }}:{{ cms_port }}
	}
	handle /api/* {
		reverse_proxy {{ docker_container }}:{{ cms_port }}
	}

	# First-party analytics (Vince) — the tracker script and event endpoint
	# are proxied same-origin with the /stats prefix stripped (vince serves
	# /js/script.js and /api/event), so they survive ad blockers and never
	# touch a third-party domain.
	handle_path /stats/* {
		reverse_proxy {{ vince_container }}:{{ vince_port }}
	}

	# TanStack Start frontend
	handle {
		reverse_proxy {{ docker_container }}:{{ www_port }}
	}
}

{{ cms_host }} {
	redir / /_/
	reverse_proxy {{ docker_container }}:{{ cms_port }}
}

# Vince analytics dashboard (login-protected). DNS for this host must point
# at this server; the tracker script itself stays on the www host at
# /stats/* — this is only for humans reading the dashboard.
{{ stats_host }} {
	reverse_proxy {{ vince_container }}:{{ vince_port }}
}