Watch Together.
Sync Perfectly.

sync.koalastuff.net {
    root * /var/www/koalasync/website/www
    encode zstd gzip
    
    # Clean URLs support (no .html required)
    try_files {path} {path}.html {path}/
    file_server
}

syncserver.koalastuff.net {
    reverse_proxy localhost:3000
}

(security_headers) {
    header {
        # Enable HTTP Strict Transport Security (HSTS)
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        # Prevent clickjacking attacks (Sameorigin)
        X-Frame-Options "SAMEORIGIN"
        # Prevent MIME-sniffing
        X-Content-Type-Options "nosniff"
        # Enable browser XSS protection
        X-XSS-Protection "1; mode=block"
        # Control referrer information
        Referrer-Policy "strict-origin-when-cross-origin"
        # Hide Caddy server stamp signature
        -Server
    }
}

sync.koalastuff.net {
    encode zstd gzip
    root * /var/www/koalasync/website/www

    # Clean URLs: Resolves paths without .html in the URL
    try_files {path} {path}.html {path}/
    file_server

    # Static Caching for high performance
    @static {
        file
        path *.ico *.css *.js *.png *.svg *.webp
    }
    header @static Cache-Control "public, max-age=31536000, must-revalidate"

    # Hardened Security & Permission Policies
    import security_headers
    header {
        Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none';"
        Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()"
    }
}

syncserver.koalastuff.net {
    import security_headers
    encode zstd gzip
    reverse_proxy KoalaSync:3000
}