-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathCaddyfile
More file actions
106 lines (88 loc) · 4.66 KB
/
Copy pathCaddyfile
File metadata and controls
106 lines (88 loc) · 4.66 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
# ============================================================
# GuardAgent - Caddy Reverse Proxy
# ============================================================
# ── Landing (guardagent.org) ──────────────────────────────
guardagent.org {
# Demo video: static, byte-range capable, short canonical URL
handle /demo.mp4 {
root * /var/www/guardagent
file_server
header Cache-Control "public, max-age=3600"
header Access-Control-Allow-Origin "*"
}
handle /demo/poster.jpg {
root * /var/www/guardagent
file_server
header Cache-Control "public, max-age=3600"
}
reverse_proxy localhost:3009
header {
X-Content-Type-Options nosniff
X-Frame-Options DENY
Referrer-Policy strict-origin-when-cross-origin
Permissions-Policy "camera=(), microphone=(), geolocation=()"
Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.privy.io https://challenges.cloudflare.com https://static.cloudflareinsights.com https://stats.unitynodes.com https://browser.sentry-cdn.com; style-src 'self' 'unsafe-inline' https://*.privy.io https://fonts.googleapis.com; img-src 'self' data: https: blob:; connect-src 'self' https://api.guardagent.org https://*.privy.io https://*.privy.systems https://auth.privy.io https://*.coinbase.com https://*.walletconnect.com https://*.coingecko.com https://hermes.pyth.network https://base.blockscout.com wss://*.walletconnect.com wss://*.privy.io https://cloudflareinsights.com https://stats.unitynodes.com https://*.sentry.io; font-src 'self' data: https://fonts.gstatic.com; frame-src https://*.privy.io https://auth.privy.io https://challenges.cloudflare.com; frame-ancestors 'none';"
-Server
}
# Immutable cache for hashed static assets
@static path /_next/static/* /icons/* /favicon.png
header @static Cache-Control "public, max-age=31536000, immutable"
# HTML responses: kill Next.js s-maxage so Cloudflare never caches HTML pages
# Match on response Content-Type so this only fires for actual page responses
@html_response header_regexp Content-Type "text/html"
header @html_response -Cache-Control
header @html_response Cache-Control "no-store, no-cache, must-revalidate"
encode gzip zstd
log {
output file /var/log/caddy/guardagent-access.log {
roll_size 10mb
roll_keep 5
}
}
}
# ── App (app.guardagent.org) ──────────────────────────────
app.guardagent.org {
reverse_proxy localhost:3009
header {
X-Content-Type-Options nosniff
X-Frame-Options DENY
Referrer-Policy strict-origin-when-cross-origin
Permissions-Policy "camera=(), microphone=(), geolocation=()"
Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.privy.io https://challenges.cloudflare.com https://static.cloudflareinsights.com https://stats.unitynodes.com https://browser.sentry-cdn.com; style-src 'self' 'unsafe-inline' https://*.privy.io https://fonts.googleapis.com; img-src 'self' data: https: blob:; connect-src 'self' https://api.guardagent.org https://*.privy.io https://*.privy.systems https://auth.privy.io https://*.coinbase.com https://*.walletconnect.com https://*.coingecko.com https://hermes.pyth.network https://base.blockscout.com wss://*.walletconnect.com wss://*.privy.io https://cloudflareinsights.com https://stats.unitynodes.com https://*.sentry.io; font-src 'self' data: https://fonts.gstatic.com; frame-src https://*.privy.io https://auth.privy.io https://challenges.cloudflare.com; frame-ancestors 'none';"
-Server
}
@static path /_next/static/* /icons/* /favicon.png
header @static Cache-Control "public, max-age=31536000, immutable"
@html_response header_regexp Content-Type "text/html"
header @html_response -Cache-Control
header @html_response Cache-Control "no-store, no-cache, must-revalidate"
encode gzip zstd
log {
output file /var/log/caddy/guardagent-app-access.log {
roll_size 10mb
roll_keep 5
}
}
}
# ── WWW → apex redirect ───────────────────────────────────
www.guardagent.org {
redir https://guardagent.org{uri} permanent
}
# ── Backend API ───────────────────────────────────────────
api.guardagent.org {
reverse_proxy localhost:3010
header {
X-Content-Type-Options nosniff
X-Frame-Options DENY
-Server
-Via
}
header Cache-Control "no-store, no-cache, must-revalidate"
encode gzip
log {
output file /var/log/caddy/guardagent-api.log {
roll_size 10mb
roll_keep 5
}
}
}