gsadmin/KoalaSync
1
0
Fork 0
mirror of https://github.com/Shik3i/KoalaSync.git synced 2026-08-03 16:07:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: update advanced caddyfile configuration for syncserver in example and website

Browse Source
This commit is contained in:
Koala
2026-06-01 01:20:14 +02:00
parent 30a4057c99
commit b08e8ba06b
8 changed files with 176 additions and 71 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Caddyfile.example
+22 -22
View File
@@ -32,6 +32,23 @@
# aggressive static assets caching, server signature concealment, and strict
# hardware permission access policies.
(security_headers) {
header {
# Enable HTTP Strict Transport Security (HSTS)
Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
# Prevent clickjacking attacks (Sameorigin)
X-Frame-Options "SAMEORIGIN"
# Prevent MIME-sniffing
X-Content-Type-Options "nosniff"
# Enable browser XSS protection
X-XSS-Protection "1; mode=block"
# Control referrer information
Referrer-Policy "strict-origin-when-cross-origin"
# Hide Caddy server stamp signature
-Server
}
}
sync.koalastuff.net {
encode zstd gzip
root * /var/www/koalasync/website/www
@@ -48,36 +65,19 @@ sync.koalastuff.net {
header @static Cache-Control "public, max-age=31536000, must-revalidate"
# Security Headers & Content Security Policy (CSP)
import security_headers
header {
# CSP hardened with base-uri and form-action limits
Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none';"
# Strict Transport Security (HSTS)
Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
# Security best practices
X-Frame-Options "DENY"
X-Content-Type-Options "nosniff"
Referrer-Policy "strict-origin-when-cross-origin"
# Modern Permissions Policy (blocks browser hardware access for enhanced privacy)
Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()"
# Remove Caddy's server stamp signature
-Server
}
}
syncserver.koalastuff.net {
reverse_proxy localhost:3000 {
header_up Host {host}
header_up X-Real-IP {remote_host}
}
header {
X-Content-Type-Options "nosniff"
X-Frame-Options "DENY"
Referrer-Policy "strict-origin-when-cross-origin"
-Server
}
import security_headers
encode zstd gzip
reverse_proxy KoalaSync:3000
}
website/template.html
+22 -7
View File
@@ -961,7 +961,24 @@
</div>
<div id="pane-caddy-advanced" class="terminal-pane">
<pre><code><span class="t-key">sync.koalastuff.net</span> {
<pre><code><span class="t-key">(security_headers)</span> {
<span class="t-key">header</span> {
<span class="t-comment"># Enable HTTP Strict Transport Security (HSTS)</span>
Strict-Transport-Security <span class="t-str">"max-age=31536000; includeSubDomains; preload"</span>
<span class="t-comment"># Prevent clickjacking attacks (Sameorigin)</span>
X-Frame-Options <span class="t-str">"SAMEORIGIN"</span>
<span class="t-comment"># Prevent MIME-sniffing</span>
X-Content-Type-Options <span class="t-str">"nosniff"</span>
<span class="t-comment"># Enable browser XSS protection</span>
X-XSS-Protection <span class="t-str">"1; mode=block"</span>
<span class="t-comment"># Control referrer information</span>
Referrer-Policy <span class="t-str">"strict-origin-when-cross-origin"</span>
<span class="t-comment"># Hide Caddy server stamp signature</span>
<span class="t-key">-Server</span>
}
}
<span class="t-key">sync.koalastuff.net</span> {
<span class="t-key">encode</span> <span class="t-val">zstd gzip</span>
<span class="t-key">root</span> <span class="t-val">*</span> <span class="t-str">/var/www/koalasync/website/www</span>
@@ -977,19 +994,17 @@
<span class="t-key">header</span> <span class="t-val">@static</span> Cache-Control <span class="t-str">"public, max-age=31536000, must-revalidate"</span>
<span class="t-comment"># Hardened Security & Permission Policies</span>
<span class="t-key">import</span> <span class="t-val">security_headers</span>
<span class="t-key">header</span> {
Content-Security-Policy <span class="t-str">"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none';"</span>
Strict-Transport-Security <span class="t-str">"max-age=31536000; includeSubDomains; preload"</span>
X-Frame-Options <span class="t-str">"DENY"</span>
X-Content-Type-Options <span class="t-str">"nosniff"</span>
Referrer-Policy <span class="t-str">"strict-origin-when-cross-origin"</span>
Permissions-Policy <span class="t-str">"camera=(), microphone=(), geolocation=(), payment=(), usb=()"</span>
<span class="t-key">-Server</span>
}
}
<span class="t-key">syncserver.koalastuff.net</span> {
<span class="t-key">reverse_proxy</span> <span class="t-val">localhost:3000</span>
<span class="t-key">import</span> <span class="t-val">security_headers</span>
<span class="t-key">encode</span> <span class="t-val">zstd gzip</span>
<span class="t-key">reverse_proxy</span> <span class="t-val">KoalaSync:3000</span>
}</code></pre>
</div>
</div>
website/www/de/index.html
+22 -7
View File
@@ -961,7 +961,24 @@
</div>
<div id="pane-caddy-advanced" class="terminal-pane">
<pre><code><span class="t-key">sync.koalastuff.net</span> {
<pre><code><span class="t-key">(security_headers)</span> {
<span class="t-key">header</span> {
<span class="t-comment"># Enable HTTP Strict Transport Security (HSTS)</span>
Strict-Transport-Security <span class="t-str">"max-age=31536000; includeSubDomains; preload"</span>
<span class="t-comment"># Prevent clickjacking attacks (Sameorigin)</span>
X-Frame-Options <span class="t-str">"SAMEORIGIN"</span>
<span class="t-comment"># Prevent MIME-sniffing</span>
X-Content-Type-Options <span class="t-str">"nosniff"</span>
<span class="t-comment"># Enable browser XSS protection</span>
X-XSS-Protection <span class="t-str">"1; mode=block"</span>
<span class="t-comment"># Control referrer information</span>
Referrer-Policy <span class="t-str">"strict-origin-when-cross-origin"</span>
<span class="t-comment"># Hide Caddy server stamp signature</span>
<span class="t-key">-Server</span>
}
}
<span class="t-key">sync.koalastuff.net</span> {
<span class="t-key">encode</span> <span class="t-val">zstd gzip</span>
<span class="t-key">root</span> <span class="t-val">*</span> <span class="t-str">/var/www/koalasync/website/www</span>
@@ -977,19 +994,17 @@
<span class="t-key">header</span> <span class="t-val">@static</span> Cache-Control <span class="t-str">"public, max-age=31536000, must-revalidate"</span>
<span class="t-comment"># Hardened Security & Permission Policies</span>
<span class="t-key">import</span> <span class="t-val">security_headers</span>
<span class="t-key">header</span> {
Content-Security-Policy <span class="t-str">"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none';"</span>
Strict-Transport-Security <span class="t-str">"max-age=31536000; includeSubDomains; preload"</span>
X-Frame-Options <span class="t-str">"DENY"</span>
X-Content-Type-Options <span class="t-str">"nosniff"</span>
Referrer-Policy <span class="t-str">"strict-origin-when-cross-origin"</span>
Permissions-Policy <span class="t-str">"camera=(), microphone=(), geolocation=(), payment=(), usb=()"</span>
<span class="t-key">-Server</span>
}
}
<span class="t-key">syncserver.koalastuff.net</span> {
<span class="t-key">reverse_proxy</span> <span class="t-val">localhost:3000</span>
<span class="t-key">import</span> <span class="t-val">security_headers</span>
<span class="t-key">encode</span> <span class="t-val">zstd gzip</span>
<span class="t-key">reverse_proxy</span> <span class="t-val">KoalaSync:3000</span>
}</code></pre>
</div>
</div>
website/www/es/index.html
+22 -7
View File
@@ -961,7 +961,24 @@
</div>
<div id="pane-caddy-advanced" class="terminal-pane">
<pre><code><span class="t-key">sync.koalastuff.net</span> {
<pre><code><span class="t-key">(security_headers)</span> {
<span class="t-key">header</span> {
<span class="t-comment"># Enable HTTP Strict Transport Security (HSTS)</span>
Strict-Transport-Security <span class="t-str">"max-age=31536000; includeSubDomains; preload"</span>
<span class="t-comment"># Prevent clickjacking attacks (Sameorigin)</span>
X-Frame-Options <span class="t-str">"SAMEORIGIN"</span>
<span class="t-comment"># Prevent MIME-sniffing</span>
X-Content-Type-Options <span class="t-str">"nosniff"</span>
<span class="t-comment"># Enable browser XSS protection</span>
X-XSS-Protection <span class="t-str">"1; mode=block"</span>
<span class="t-comment"># Control referrer information</span>
Referrer-Policy <span class="t-str">"strict-origin-when-cross-origin"</span>
<span class="t-comment"># Hide Caddy server stamp signature</span>
<span class="t-key">-Server</span>
}
}
<span class="t-key">sync.koalastuff.net</span> {
<span class="t-key">encode</span> <span class="t-val">zstd gzip</span>
<span class="t-key">root</span> <span class="t-val">*</span> <span class="t-str">/var/www/koalasync/website/www</span>
@@ -977,19 +994,17 @@
<span class="t-key">header</span> <span class="t-val">@static</span> Cache-Control <span class="t-str">"public, max-age=31536000, must-revalidate"</span>
<span class="t-comment"># Hardened Security & Permission Policies</span>
<span class="t-key">import</span> <span class="t-val">security_headers</span>
<span class="t-key">header</span> {
Content-Security-Policy <span class="t-str">"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none';"</span>
Strict-Transport-Security <span class="t-str">"max-age=31536000; includeSubDomains; preload"</span>
X-Frame-Options <span class="t-str">"DENY"</span>
X-Content-Type-Options <span class="t-str">"nosniff"</span>
Referrer-Policy <span class="t-str">"strict-origin-when-cross-origin"</span>
Permissions-Policy <span class="t-str">"camera=(), microphone=(), geolocation=(), payment=(), usb=()"</span>
<span class="t-key">-Server</span>
}
}
<span class="t-key">syncserver.koalastuff.net</span> {
<span class="t-key">reverse_proxy</span> <span class="t-val">localhost:3000</span>
<span class="t-key">import</span> <span class="t-val">security_headers</span>
<span class="t-key">encode</span> <span class="t-val">zstd gzip</span>
<span class="t-key">reverse_proxy</span> <span class="t-val">KoalaSync:3000</span>
}</code></pre>
</div>
</div>
website/www/fr/index.html
+22 -7
View File
@@ -961,7 +961,24 @@
</div>
<div id="pane-caddy-advanced" class="terminal-pane">
<pre><code><span class="t-key">sync.koalastuff.net</span> {
<pre><code><span class="t-key">(security_headers)</span> {
<span class="t-key">header</span> {
<span class="t-comment"># Enable HTTP Strict Transport Security (HSTS)</span>
Strict-Transport-Security <span class="t-str">"max-age=31536000; includeSubDomains; preload"</span>
<span class="t-comment"># Prevent clickjacking attacks (Sameorigin)</span>
X-Frame-Options <span class="t-str">"SAMEORIGIN"</span>
<span class="t-comment"># Prevent MIME-sniffing</span>
X-Content-Type-Options <span class="t-str">"nosniff"</span>
<span class="t-comment"># Enable browser XSS protection</span>
X-XSS-Protection <span class="t-str">"1; mode=block"</span>
<span class="t-comment"># Control referrer information</span>
Referrer-Policy <span class="t-str">"strict-origin-when-cross-origin"</span>
<span class="t-comment"># Hide Caddy server stamp signature</span>
<span class="t-key">-Server</span>
}
}
<span class="t-key">sync.koalastuff.net</span> {
<span class="t-key">encode</span> <span class="t-val">zstd gzip</span>
<span class="t-key">root</span> <span class="t-val">*</span> <span class="t-str">/var/www/koalasync/website/www</span>
@@ -977,19 +994,17 @@
<span class="t-key">header</span> <span class="t-val">@static</span> Cache-Control <span class="t-str">"public, max-age=31536000, must-revalidate"</span>
<span class="t-comment"># Hardened Security & Permission Policies</span>
<span class="t-key">import</span> <span class="t-val">security_headers</span>
<span class="t-key">header</span> {
Content-Security-Policy <span class="t-str">"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none';"</span>
Strict-Transport-Security <span class="t-str">"max-age=31536000; includeSubDomains; preload"</span>
X-Frame-Options <span class="t-str">"DENY"</span>
X-Content-Type-Options <span class="t-str">"nosniff"</span>
Referrer-Policy <span class="t-str">"strict-origin-when-cross-origin"</span>
Permissions-Policy <span class="t-str">"camera=(), microphone=(), geolocation=(), payment=(), usb=()"</span>
<span class="t-key">-Server</span>
}
}
<span class="t-key">syncserver.koalastuff.net</span> {
<span class="t-key">reverse_proxy</span> <span class="t-val">localhost:3000</span>
<span class="t-key">import</span> <span class="t-val">security_headers</span>
<span class="t-key">encode</span> <span class="t-val">zstd gzip</span>
<span class="t-key">reverse_proxy</span> <span class="t-val">KoalaSync:3000</span>
}</code></pre>
</div>
</div>
website/www/index.html
+22 -7
View File
@@ -961,7 +961,24 @@
</div>
<div id="pane-caddy-advanced" class="terminal-pane">
<pre><code><span class="t-key">sync.koalastuff.net</span> {
<pre><code><span class="t-key">(security_headers)</span> {
<span class="t-key">header</span> {
<span class="t-comment"># Enable HTTP Strict Transport Security (HSTS)</span>
Strict-Transport-Security <span class="t-str">"max-age=31536000; includeSubDomains; preload"</span>
<span class="t-comment"># Prevent clickjacking attacks (Sameorigin)</span>
X-Frame-Options <span class="t-str">"SAMEORIGIN"</span>
<span class="t-comment"># Prevent MIME-sniffing</span>
X-Content-Type-Options <span class="t-str">"nosniff"</span>
<span class="t-comment"># Enable browser XSS protection</span>
X-XSS-Protection <span class="t-str">"1; mode=block"</span>
<span class="t-comment"># Control referrer information</span>
Referrer-Policy <span class="t-str">"strict-origin-when-cross-origin"</span>
<span class="t-comment"># Hide Caddy server stamp signature</span>
<span class="t-key">-Server</span>
}
}
<span class="t-key">sync.koalastuff.net</span> {
<span class="t-key">encode</span> <span class="t-val">zstd gzip</span>
<span class="t-key">root</span> <span class="t-val">*</span> <span class="t-str">/var/www/koalasync/website/www</span>
@@ -977,19 +994,17 @@
<span class="t-key">header</span> <span class="t-val">@static</span> Cache-Control <span class="t-str">"public, max-age=31536000, must-revalidate"</span>
<span class="t-comment"># Hardened Security & Permission Policies</span>
<span class="t-key">import</span> <span class="t-val">security_headers</span>
<span class="t-key">header</span> {
Content-Security-Policy <span class="t-str">"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none';"</span>
Strict-Transport-Security <span class="t-str">"max-age=31536000; includeSubDomains; preload"</span>
X-Frame-Options <span class="t-str">"DENY"</span>
X-Content-Type-Options <span class="t-str">"nosniff"</span>
Referrer-Policy <span class="t-str">"strict-origin-when-cross-origin"</span>
Permissions-Policy <span class="t-str">"camera=(), microphone=(), geolocation=(), payment=(), usb=()"</span>
<span class="t-key">-Server</span>
}
}
<span class="t-key">syncserver.koalastuff.net</span> {
<span class="t-key">reverse_proxy</span> <span class="t-val">localhost:3000</span>
<span class="t-key">import</span> <span class="t-val">security_headers</span>
<span class="t-key">encode</span> <span class="t-val">zstd gzip</span>
<span class="t-key">reverse_proxy</span> <span class="t-val">KoalaSync:3000</span>
}</code></pre>
</div>
</div>
website/www/pt-BR/index.html
+22 -7
View File
@@ -961,7 +961,24 @@
</div>
<div id="pane-caddy-advanced" class="terminal-pane">
<pre><code><span class="t-key">sync.koalastuff.net</span> {
<pre><code><span class="t-key">(security_headers)</span> {
<span class="t-key">header</span> {
<span class="t-comment"># Enable HTTP Strict Transport Security (HSTS)</span>
Strict-Transport-Security <span class="t-str">"max-age=31536000; includeSubDomains; preload"</span>
<span class="t-comment"># Prevent clickjacking attacks (Sameorigin)</span>
X-Frame-Options <span class="t-str">"SAMEORIGIN"</span>
<span class="t-comment"># Prevent MIME-sniffing</span>
X-Content-Type-Options <span class="t-str">"nosniff"</span>
<span class="t-comment"># Enable browser XSS protection</span>
X-XSS-Protection <span class="t-str">"1; mode=block"</span>
<span class="t-comment"># Control referrer information</span>
Referrer-Policy <span class="t-str">"strict-origin-when-cross-origin"</span>
<span class="t-comment"># Hide Caddy server stamp signature</span>
<span class="t-key">-Server</span>
}
}
<span class="t-key">sync.koalastuff.net</span> {
<span class="t-key">encode</span> <span class="t-val">zstd gzip</span>
<span class="t-key">root</span> <span class="t-val">*</span> <span class="t-str">/var/www/koalasync/website/www</span>
@@ -977,19 +994,17 @@
<span class="t-key">header</span> <span class="t-val">@static</span> Cache-Control <span class="t-str">"public, max-age=31536000, must-revalidate"</span>
<span class="t-comment"># Hardened Security & Permission Policies</span>
<span class="t-key">import</span> <span class="t-val">security_headers</span>
<span class="t-key">header</span> {
Content-Security-Policy <span class="t-str">"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none';"</span>
Strict-Transport-Security <span class="t-str">"max-age=31536000; includeSubDomains; preload"</span>
X-Frame-Options <span class="t-str">"DENY"</span>
X-Content-Type-Options <span class="t-str">"nosniff"</span>
Referrer-Policy <span class="t-str">"strict-origin-when-cross-origin"</span>
Permissions-Policy <span class="t-str">"camera=(), microphone=(), geolocation=(), payment=(), usb=()"</span>
<span class="t-key">-Server</span>
}
}
<span class="t-key">syncserver.koalastuff.net</span> {
<span class="t-key">reverse_proxy</span> <span class="t-val">localhost:3000</span>
<span class="t-key">import</span> <span class="t-val">security_headers</span>
<span class="t-key">encode</span> <span class="t-val">zstd gzip</span>
<span class="t-key">reverse_proxy</span> <span class="t-val">KoalaSync:3000</span>
}</code></pre>
</div>
</div>
website/www/ru/index.html
+22 -7
View File
@@ -961,7 +961,24 @@
</div>
<div id="pane-caddy-advanced" class="terminal-pane">
<pre><code><span class="t-key">sync.koalastuff.net</span> {
<pre><code><span class="t-key">(security_headers)</span> {
<span class="t-key">header</span> {
<span class="t-comment"># Enable HTTP Strict Transport Security (HSTS)</span>
Strict-Transport-Security <span class="t-str">"max-age=31536000; includeSubDomains; preload"</span>
<span class="t-comment"># Prevent clickjacking attacks (Sameorigin)</span>
X-Frame-Options <span class="t-str">"SAMEORIGIN"</span>
<span class="t-comment"># Prevent MIME-sniffing</span>
X-Content-Type-Options <span class="t-str">"nosniff"</span>
<span class="t-comment"># Enable browser XSS protection</span>
X-XSS-Protection <span class="t-str">"1; mode=block"</span>
<span class="t-comment"># Control referrer information</span>
Referrer-Policy <span class="t-str">"strict-origin-when-cross-origin"</span>
<span class="t-comment"># Hide Caddy server stamp signature</span>
<span class="t-key">-Server</span>
}
}
<span class="t-key">sync.koalastuff.net</span> {
<span class="t-key">encode</span> <span class="t-val">zstd gzip</span>
<span class="t-key">root</span> <span class="t-val">*</span> <span class="t-str">/var/www/koalasync/website/www</span>
@@ -977,19 +994,17 @@
<span class="t-key">header</span> <span class="t-val">@static</span> Cache-Control <span class="t-str">"public, max-age=31536000, must-revalidate"</span>
<span class="t-comment"># Hardened Security & Permission Policies</span>
<span class="t-key">import</span> <span class="t-val">security_headers</span>
<span class="t-key">header</span> {
Content-Security-Policy <span class="t-str">"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none';"</span>
Strict-Transport-Security <span class="t-str">"max-age=31536000; includeSubDomains; preload"</span>
X-Frame-Options <span class="t-str">"DENY"</span>
X-Content-Type-Options <span class="t-str">"nosniff"</span>
Referrer-Policy <span class="t-str">"strict-origin-when-cross-origin"</span>
Permissions-Policy <span class="t-str">"camera=(), microphone=(), geolocation=(), payment=(), usb=()"</span>
<span class="t-key">-Server</span>
}
}
<span class="t-key">syncserver.koalastuff.net</span> {
<span class="t-key">reverse_proxy</span> <span class="t-val">localhost:3000</span>
<span class="t-key">import</span> <span class="t-val">security_headers</span>
<span class="t-key">encode</span> <span class="t-val">zstd gzip</span>
<span class="t-key">reverse_proxy</span> <span class="t-val">KoalaSync:3000</span>
}</code></pre>
</div>
</div>