http:
  middlewares:
    # EN: Secure headers for LOCAL DEVELOPMENT only
    # VI: Secure headers CHỈ cho LOCAL DEVELOPMENT
    # WARNING: sslRedirect is disabled for local dev. Staging/prod MUST use secure-headers-prod.
    secure-headers:
      headers:
        sslRedirect: false  # EN: Disabled for local development / VI: Tắt cho local development
        stsSeconds: 31536000
        contentTypeNosniff: true
        browserXssFilter: true
        frameDeny: true
        # EN: Content-Security-Policy for Blazor WASM (wasm-unsafe-eval required for .NET runtime)
        # VI: CSP cho Blazor WASM (wasm-unsafe-eval bắt buộc cho .NET runtime)
        contentSecurityPolicy: >-
          default-src 'self';
          script-src 'self' 'wasm-unsafe-eval';
          style-src 'self' 'unsafe-inline';
          img-src 'self' data: blob:;
          connect-src 'self' wss: https:;
          font-src 'self';
          frame-ancestors 'none';
          object-src 'none';
          base-uri 'self';

    # EN: Secure headers for STAGING and PRODUCTION — sslRedirect ENABLED
    # VI: Secure headers cho STAGING và PRODUCTION — sslRedirect BẬT
    secure-headers-prod:
      headers:
        sslRedirect: true
        stsSeconds: 31536000
        stsIncludeSubdomains: true
        stsPreload: true
        contentTypeNosniff: true
        browserXssFilter: true
        frameDeny: true
        contentSecurityPolicy: >-
          default-src 'self';
          script-src 'self' 'wasm-unsafe-eval';
          style-src 'self' 'unsafe-inline';
          img-src 'self' data: blob:;
          connect-src 'self' wss: https:;
          font-src 'self';
          frame-ancestors 'none';
          object-src 'none';
          base-uri 'self';

    # EN: CORS for LOCAL DEVELOPMENT — allows localhost origins and credentials
    # VI: CORS cho LOCAL DEVELOPMENT — cho phép localhost origins và credentials
    # WARNING: DO NOT use in staging/prod. Use cors-prod instead.
    cors:
      headers:
        accessControlAllowMethods:
          - GET
          - POST
          - PUT
          - DELETE
          - PATCH
          - OPTIONS
        accessControlAllowOriginList:
          - "http://localhost:3000"
          - "http://localhost:3001"
          - "http://localhost:5000"
          - "http://localhost:5173"
        accessControlAllowHeaders:
          - Content-Type
          - Authorization
        accessControlAllowCredentials: true
        accessControlMaxAge: 86400

    # EN: CORS for STAGING — only staging domains, credentials allowed
    # VI: CORS cho STAGING — chỉ staging domains, cho phép credentials
    cors-staging:
      headers:
        accessControlAllowMethods:
          - GET
          - POST
          - PUT
          - DELETE
          - PATCH
          - OPTIONS
        accessControlAllowOriginList:
          - "https://pos.staging.goodgo.vn"
          - "https://staging.goodgo.vn"
          - "https://admin.staging.goodgo.vn"
        accessControlAllowHeaders:
          - Content-Type
          - Authorization
        accessControlAllowCredentials: true
        accessControlMaxAge: 86400

    # EN: CORS for PRODUCTION — only production domains, credentials allowed
    # VI: CORS cho PRODUCTION — chỉ production domains, cho phép credentials
    cors-prod:
      headers:
        accessControlAllowMethods:
          - GET
          - POST
          - PUT
          - DELETE
          - PATCH
          - OPTIONS
        accessControlAllowOriginList:
          - "https://goodgo.vn"
          - "https://admin.goodgo.vn"
          - "https://pos.goodgo.vn"
        accessControlAllowHeaders:
          - Content-Type
          - Authorization
        accessControlAllowCredentials: true
        accessControlMaxAge: 86400

    # EN: STRICT rate limit for auth endpoints (login, register, 2FA) - 10 req/min per IP
    # VI: Rate limit NGHIÊM NGẶT cho auth endpoints (login, register, 2FA) - 10 req/phút mỗi IP
    auth-ratelimit:
      rateLimit:
        average: 10
        burst: 5

    # EN: STRICT rate limit for payment endpoints - 30 req/min per IP
    # VI: Rate limit NGHIÊM NGẶT cho payment endpoints - 30 req/phút mỗi IP
    payment-ratelimit:
      rateLimit:
        average: 30
        burst: 10

    # EN: MODERATE rate limit for general API - 100 req/min per IP
    # VI: Rate limit VỪA PHẢI cho API chung - 100 req/phút mỗi IP
    api-ratelimit:
      rateLimit:
        average: 100
        burst: 50

    # EN: RELAXED rate limit for SignalR hubs (real-time needs higher limits) - 500 req/min
    # VI: Rate limit THOẢI MÁI cho SignalR hubs (real-time cần giới hạn cao hơn) - 500 req/phút
    hub-ratelimit:
      rateLimit:
        average: 500
        burst: 100

    compress:
      compress: {}
