diff --git a/Caddyfile.example b/Caddyfile.example index e7395eb..99b081d 100644 --- a/Caddyfile.example +++ b/Caddyfile.example @@ -32,6 +32,23 @@ # aggressive static assets caching, server signature concealment, and strict # hardware permission access policies. +(security_headers) { + header { + # Enable HTTP Strict Transport Security (HSTS) + Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" + # Prevent clickjacking attacks (Sameorigin) + X-Frame-Options "SAMEORIGIN" + # Prevent MIME-sniffing + X-Content-Type-Options "nosniff" + # Enable browser XSS protection + X-XSS-Protection "1; mode=block" + # Control referrer information + Referrer-Policy "strict-origin-when-cross-origin" + # Hide Caddy server stamp signature + -Server + } +} + sync.koalastuff.net { encode zstd gzip root * /var/www/koalasync/website/www @@ -48,36 +65,19 @@ sync.koalastuff.net { header @static Cache-Control "public, max-age=31536000, must-revalidate" # Security Headers & Content Security Policy (CSP) + import security_headers header { # CSP hardened with base-uri and form-action limits Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none';" - # Strict Transport Security (HSTS) - Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" - - # Security best practices - X-Frame-Options "DENY" - X-Content-Type-Options "nosniff" - Referrer-Policy "strict-origin-when-cross-origin" - # Modern Permissions Policy (blocks browser hardware access for enhanced privacy) Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()" - - # Remove Caddy's server stamp signature - -Server } } syncserver.koalastuff.net { - reverse_proxy localhost:3000 { - header_up Host {host} - header_up X-Real-IP {remote_host} - } - - header { - X-Content-Type-Options "nosniff" - X-Frame-Options "DENY" - Referrer-Policy "strict-origin-when-cross-origin" - -Server - } + import security_headers + encode zstd gzip + reverse_proxy KoalaSync:3000 } + diff --git a/website/template.html b/website/template.html index abf78ff..56e0860 100644 --- a/website/template.html +++ b/website/template.html @@ -961,7 +961,24 @@
- 
sync.koalastuff.net {
+                        
(security_headers) {
+    header {
+        # Enable HTTP Strict Transport Security (HSTS)
+        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+        # Prevent clickjacking attacks (Sameorigin)
+        X-Frame-Options "SAMEORIGIN"
+        # Prevent MIME-sniffing
+        X-Content-Type-Options "nosniff"
+        # Enable browser XSS protection
+        X-XSS-Protection "1; mode=block"
+        # Control referrer information
+        Referrer-Policy "strict-origin-when-cross-origin"
+        # Hide Caddy server stamp signature
+        -Server
+    }
+}
+
+sync.koalastuff.net {
     encode zstd gzip
     root * /var/www/koalasync/website/www
 
@@ -977,19 +994,17 @@
     header @static Cache-Control "public, max-age=31536000, must-revalidate"
 
     # Hardened Security & Permission Policies
+    import security_headers
     header {
         Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none';"
-        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
-        X-Frame-Options "DENY"
-        X-Content-Type-Options "nosniff"
-        Referrer-Policy "strict-origin-when-cross-origin"
         Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()"
-        -Server
     }
 }
 
 syncserver.koalastuff.net {
-    reverse_proxy localhost:3000
+    import security_headers
+    encode zstd gzip
+    reverse_proxy KoalaSync:3000
 }
diff --git a/website/www/de/index.html b/website/www/de/index.html index 1f5c5fd..e02d6b4 100644 --- a/website/www/de/index.html +++ b/website/www/de/index.html @@ -961,7 +961,24 @@
- 
sync.koalastuff.net {
+                        
(security_headers) {
+    header {
+        # Enable HTTP Strict Transport Security (HSTS)
+        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+        # Prevent clickjacking attacks (Sameorigin)
+        X-Frame-Options "SAMEORIGIN"
+        # Prevent MIME-sniffing
+        X-Content-Type-Options "nosniff"
+        # Enable browser XSS protection
+        X-XSS-Protection "1; mode=block"
+        # Control referrer information
+        Referrer-Policy "strict-origin-when-cross-origin"
+        # Hide Caddy server stamp signature
+        -Server
+    }
+}
+
+sync.koalastuff.net {
     encode zstd gzip
     root * /var/www/koalasync/website/www
 
@@ -977,19 +994,17 @@
     header @static Cache-Control "public, max-age=31536000, must-revalidate"
 
     # Hardened Security & Permission Policies
+    import security_headers
     header {
         Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none';"
-        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
-        X-Frame-Options "DENY"
-        X-Content-Type-Options "nosniff"
-        Referrer-Policy "strict-origin-when-cross-origin"
         Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()"
-        -Server
     }
 }
 
 syncserver.koalastuff.net {
-    reverse_proxy localhost:3000
+    import security_headers
+    encode zstd gzip
+    reverse_proxy KoalaSync:3000
 }
diff --git a/website/www/es/index.html b/website/www/es/index.html index 2afecdc..1fd56ab 100644 --- a/website/www/es/index.html +++ b/website/www/es/index.html @@ -961,7 +961,24 @@
- 
sync.koalastuff.net {
+                        
(security_headers) {
+    header {
+        # Enable HTTP Strict Transport Security (HSTS)
+        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+        # Prevent clickjacking attacks (Sameorigin)
+        X-Frame-Options "SAMEORIGIN"
+        # Prevent MIME-sniffing
+        X-Content-Type-Options "nosniff"
+        # Enable browser XSS protection
+        X-XSS-Protection "1; mode=block"
+        # Control referrer information
+        Referrer-Policy "strict-origin-when-cross-origin"
+        # Hide Caddy server stamp signature
+        -Server
+    }
+}
+
+sync.koalastuff.net {
     encode zstd gzip
     root * /var/www/koalasync/website/www
 
@@ -977,19 +994,17 @@
     header @static Cache-Control "public, max-age=31536000, must-revalidate"
 
     # Hardened Security & Permission Policies
+    import security_headers
     header {
         Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none';"
-        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
-        X-Frame-Options "DENY"
-        X-Content-Type-Options "nosniff"
-        Referrer-Policy "strict-origin-when-cross-origin"
         Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()"
-        -Server
     }
 }
 
 syncserver.koalastuff.net {
-    reverse_proxy localhost:3000
+    import security_headers
+    encode zstd gzip
+    reverse_proxy KoalaSync:3000
 }
diff --git a/website/www/fr/index.html b/website/www/fr/index.html index 6f8ee45..6c9e0f5 100644 --- a/website/www/fr/index.html +++ b/website/www/fr/index.html @@ -961,7 +961,24 @@
- 
sync.koalastuff.net {
+                        
(security_headers) {
+    header {
+        # Enable HTTP Strict Transport Security (HSTS)
+        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+        # Prevent clickjacking attacks (Sameorigin)
+        X-Frame-Options "SAMEORIGIN"
+        # Prevent MIME-sniffing
+        X-Content-Type-Options "nosniff"
+        # Enable browser XSS protection
+        X-XSS-Protection "1; mode=block"
+        # Control referrer information
+        Referrer-Policy "strict-origin-when-cross-origin"
+        # Hide Caddy server stamp signature
+        -Server
+    }
+}
+
+sync.koalastuff.net {
     encode zstd gzip
     root * /var/www/koalasync/website/www
 
@@ -977,19 +994,17 @@
     header @static Cache-Control "public, max-age=31536000, must-revalidate"
 
     # Hardened Security & Permission Policies
+    import security_headers
     header {
         Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none';"
-        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
-        X-Frame-Options "DENY"
-        X-Content-Type-Options "nosniff"
-        Referrer-Policy "strict-origin-when-cross-origin"
         Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()"
-        -Server
     }
 }
 
 syncserver.koalastuff.net {
-    reverse_proxy localhost:3000
+    import security_headers
+    encode zstd gzip
+    reverse_proxy KoalaSync:3000
 }
diff --git a/website/www/index.html b/website/www/index.html index 82c252f..1b12217 100644 --- a/website/www/index.html +++ b/website/www/index.html @@ -961,7 +961,24 @@
- 
sync.koalastuff.net {
+                        
(security_headers) {
+    header {
+        # Enable HTTP Strict Transport Security (HSTS)
+        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+        # Prevent clickjacking attacks (Sameorigin)
+        X-Frame-Options "SAMEORIGIN"
+        # Prevent MIME-sniffing
+        X-Content-Type-Options "nosniff"
+        # Enable browser XSS protection
+        X-XSS-Protection "1; mode=block"
+        # Control referrer information
+        Referrer-Policy "strict-origin-when-cross-origin"
+        # Hide Caddy server stamp signature
+        -Server
+    }
+}
+
+sync.koalastuff.net {
     encode zstd gzip
     root * /var/www/koalasync/website/www
 
@@ -977,19 +994,17 @@
     header @static Cache-Control "public, max-age=31536000, must-revalidate"
 
     # Hardened Security & Permission Policies
+    import security_headers
     header {
         Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none';"
-        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
-        X-Frame-Options "DENY"
-        X-Content-Type-Options "nosniff"
-        Referrer-Policy "strict-origin-when-cross-origin"
         Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()"
-        -Server
     }
 }
 
 syncserver.koalastuff.net {
-    reverse_proxy localhost:3000
+    import security_headers
+    encode zstd gzip
+    reverse_proxy KoalaSync:3000
 }
diff --git a/website/www/pt-BR/index.html b/website/www/pt-BR/index.html index 7b88689..d9e3f30 100644 --- a/website/www/pt-BR/index.html +++ b/website/www/pt-BR/index.html @@ -961,7 +961,24 @@
- 
sync.koalastuff.net {
+                        
(security_headers) {
+    header {
+        # Enable HTTP Strict Transport Security (HSTS)
+        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+        # Prevent clickjacking attacks (Sameorigin)
+        X-Frame-Options "SAMEORIGIN"
+        # Prevent MIME-sniffing
+        X-Content-Type-Options "nosniff"
+        # Enable browser XSS protection
+        X-XSS-Protection "1; mode=block"
+        # Control referrer information
+        Referrer-Policy "strict-origin-when-cross-origin"
+        # Hide Caddy server stamp signature
+        -Server
+    }
+}
+
+sync.koalastuff.net {
     encode zstd gzip
     root * /var/www/koalasync/website/www
 
@@ -977,19 +994,17 @@
     header @static Cache-Control "public, max-age=31536000, must-revalidate"
 
     # Hardened Security & Permission Policies
+    import security_headers
     header {
         Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none';"
-        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
-        X-Frame-Options "DENY"
-        X-Content-Type-Options "nosniff"
-        Referrer-Policy "strict-origin-when-cross-origin"
         Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()"
-        -Server
     }
 }
 
 syncserver.koalastuff.net {
-    reverse_proxy localhost:3000
+    import security_headers
+    encode zstd gzip
+    reverse_proxy KoalaSync:3000
 }
diff --git a/website/www/ru/index.html b/website/www/ru/index.html index a1d1725..d47f1b3 100644 --- a/website/www/ru/index.html +++ b/website/www/ru/index.html @@ -961,7 +961,24 @@
- 
sync.koalastuff.net {
+                        
(security_headers) {
+    header {
+        # Enable HTTP Strict Transport Security (HSTS)
+        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+        # Prevent clickjacking attacks (Sameorigin)
+        X-Frame-Options "SAMEORIGIN"
+        # Prevent MIME-sniffing
+        X-Content-Type-Options "nosniff"
+        # Enable browser XSS protection
+        X-XSS-Protection "1; mode=block"
+        # Control referrer information
+        Referrer-Policy "strict-origin-when-cross-origin"
+        # Hide Caddy server stamp signature
+        -Server
+    }
+}
+
+sync.koalastuff.net {
     encode zstd gzip
     root * /var/www/koalasync/website/www
 
@@ -977,19 +994,17 @@
     header @static Cache-Control "public, max-age=31536000, must-revalidate"
 
     # Hardened Security & Permission Policies
+    import security_headers
     header {
         Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none';"
-        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
-        X-Frame-Options "DENY"
-        X-Content-Type-Options "nosniff"
-        Referrer-Policy "strict-origin-when-cross-origin"
         Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()"
-        -Server
     }
 }
 
 syncserver.koalastuff.net {
-    reverse_proxy localhost:3000
+    import security_headers
+    encode zstd gzip
+    reverse_proxy KoalaSync:3000
 }