Recipe: single-page app + API

A SPA serves immutable hashed assets you want cached for a long time, plus a dynamic API under /api that must never be cached. Path rules split the two.

[[proxy_rules]]
domain = "app.example.com"
forward_ipv4 = "10.0.0.8"
forward_port_https = 443
max_age_seconds = 60
rule_type = "Whitelist"
redirect_to_https = true
enable_compression = true
compression_flags = "br, gzip"
enable_sql_injection_protection = true

[[proxy_rules.path_rules]]
path = "/assets"
match_type = "StartsWith"
rule_type = "Whitelist"
max_age_seconds = 31536000

[[proxy_rules.path_rules]]
path = "/api"
match_type = "StartsWith"
rule_type = "Whitelist"
max_age_seconds = 0

• Hashed assets under /assets cached for a year — safe because the filename changes on every deploy.
• /api forced to a zero lifetime so responses are always fresh.
• SQL-injection screening on, since the API reaches a database (remember the global add_sql_injection_protection must also be on).