https://matrix.DOMAIN {
	tls /matrix/ssl/config/live/matrix.DOMAIN/fullchain.pem /matrix/ssl/config/live/matrix.DOMAIN/privkey.pem

	root /matrix/static-files

	header {
		Access-Control-Allow-Origin *
		Strict-Transport-Security "mag=age=31536000;"
		X-Frame-Options "DENY"
		X-XSS-Protection "1; mode=block"
	}

	proxy /_matrix/identity matrix-msisd:8090 {
		transparent
	}

	proxy /_matrix/client/r0/user_directory/search matrix-msisd:8090 {
		transparent
	}

	proxy / matrix-synapse:8008 {
		transparent
		without /.well-known/ /_matrix/identity/ /_matrix/client/r0/user_directory/search
	}

}