:80 {
    @mcp path /mcp /mcp/*
    @cdpVersion path /json/version /json/version/

    handle @mcp {
        @authorized header Authorization "Bearer {${OBSCURA_API_TOKEN}}"

        handle @authorized {
            reverse_proxy obscura-mcp:3000
        }

        respond "Unauthorized" 401
    }

    handle @cdpVersion {
        @authorized header Authorization "Bearer {${OBSCURA_API_TOKEN}}"

        handle @authorized {
            header Content-Type application/json
            respond `{"Browser":"Obscura","Protocol-Version":"1.3","webSocketDebuggerUrl":"wss://{${OBSCURA_HOST}}/devtools/browser?access_token={${OBSCURA_API_TOKEN}}"}` 200
        }

        respond "Unauthorized" 401
    }

    handle {
        @authorizedByHeader header Authorization "Bearer {${OBSCURA_API_TOKEN}}"
        @authorizedByQuery {
            path /devtools/*
            query access_token={${OBSCURA_API_TOKEN}}
        }

        handle @authorizedByHeader {
            reverse_proxy obscura-cdp:9222
        }

        handle @authorizedByQuery {
            reverse_proxy obscura-cdp:9222
        }

        respond "Unauthorized" 401
    }
}
