{
	admin off
	auto_https off
}

:7860 {
	# Password gate for the whole Lab. Set LAB_USER and LAB_PASSWORD_HASH
	# as environment variables / Fly secrets (see deploy/DEPLOY.md).
	basic_auth {
		{$LAB_USER} {$LAB_PASSWORD_HASH}
	}

	# Engine: /api/* is stripped to / and proxied to FastAPI.
	# reverse_proxy streams Server-Sent Events without extra config.
	handle_path /api/* {
		reverse_proxy 127.0.0.1:8000
	}

	# Everything else is the Next.js front end.
	handle {
		reverse_proxy 127.0.0.1:3000
	}
}