docs: update advanced caddyfile configuration for syncserver in example and website

Caddyfile.example

@@ -32,6 +32,23 @@
 # aggressive static assets caching, server signature concealment, and strict 
 # hardware permission access policies.
 
+(security_headers) {
+	header {
+		# Enable HTTP Strict Transport Security (HSTS)
+		Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+		# Prevent clickjacking attacks (Sameorigin)
+		X-Frame-Options "SAMEORIGIN"
+		# Prevent MIME-sniffing
+		X-Content-Type-Options "nosniff"
+		# Enable browser XSS protection
+		X-XSS-Protection "1; mode=block"
+		# Control referrer information
+		Referrer-Policy "strict-origin-when-cross-origin"
+		# Hide Caddy server stamp signature
+		-Server
+	}
+}
+
 sync.koalastuff.net {
     encode zstd gzip
     root * /var/www/koalasync/website/www
@@ -48,36 +65,19 @@ sync.koalastuff.net {
     header @static Cache-Control "public, max-age=31536000, must-revalidate"
 
     # Security Headers & Content Security Policy (CSP)
+    import security_headers
     header {
         # CSP hardened with base-uri and form-action limits
         Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none';"
         
-        # Strict Transport Security (HSTS)
-        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
-        
-        # Security best practices
-        X-Frame-Options "DENY"
-        X-Content-Type-Options "nosniff"
-        Referrer-Policy "strict-origin-when-cross-origin"
-        
         # Modern Permissions Policy (blocks browser hardware access for enhanced privacy)
         Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()"
-        
-        # Remove Caddy's server stamp signature
-        -Server
     }
 }
 
 syncserver.koalastuff.net {
-    reverse_proxy localhost:3000 {
+	import security_headers
-        header_up Host {host}
+	encode zstd gzip
-        header_up X-Real-IP {remote_host}
+	reverse_proxy KoalaSync:3000
-    }
-
-    header {
-        X-Content-Type-Options "nosniff"
-        X-Frame-Options "DENY"
-        Referrer-Policy "strict-origin-when-cross-origin"
-        -Server
-    }
 }
+

website/template.html

@@ -961,7 +961,24 @@
                     </div>
 
                     <div id="pane-caddy-advanced" class="terminal-pane">
-                        <pre><code><span class="t-key">sync.koalastuff.net</span> {
+                        <pre><code><span class="t-key">(security_headers)</span> {
+    <span class="t-key">header</span> {
+        <span class="t-comment"># Enable HTTP Strict Transport Security (HSTS)</span>
+        Strict-Transport-Security <span class="t-str">"max-age=31536000; includeSubDomains; preload"</span>
+        <span class="t-comment"># Prevent clickjacking attacks (Sameorigin)</span>
+        X-Frame-Options <span class="t-str">"SAMEORIGIN"</span>
+        <span class="t-comment"># Prevent MIME-sniffing</span>
+        X-Content-Type-Options <span class="t-str">"nosniff"</span>
+        <span class="t-comment"># Enable browser XSS protection</span>
+        X-XSS-Protection <span class="t-str">"1; mode=block"</span>
+        <span class="t-comment"># Control referrer information</span>
+        Referrer-Policy <span class="t-str">"strict-origin-when-cross-origin"</span>
+        <span class="t-comment"># Hide Caddy server stamp signature</span>
+        <span class="t-key">-Server</span>
+    }
+}
+
+<span class="t-key">sync.koalastuff.net</span> {
     <span class="t-key">encode</span> <span class="t-val">zstd gzip</span>
     <span class="t-key">root</span> <span class="t-val">*</span> <span class="t-str">/var/www/koalasync/website/www</span>
 
@@ -977,19 +994,17 @@
     <span class="t-key">header</span> <span class="t-val">@static</span> Cache-Control <span class="t-str">"public, max-age=31536000, must-revalidate"</span>
 
     <span class="t-comment"># Hardened Security & Permission Policies</span>
+    <span class="t-key">import</span> <span class="t-val">security_headers</span>
     <span class="t-key">header</span> {
         Content-Security-Policy <span class="t-str">"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none';"</span>
-        Strict-Transport-Security <span class="t-str">"max-age=31536000; includeSubDomains; preload"</span>
-        X-Frame-Options <span class="t-str">"DENY"</span>
-        X-Content-Type-Options <span class="t-str">"nosniff"</span>
-        Referrer-Policy <span class="t-str">"strict-origin-when-cross-origin"</span>
         Permissions-Policy <span class="t-str">"camera=(), microphone=(), geolocation=(), payment=(), usb=()"</span>
-        <span class="t-key">-Server</span>
     }
 }
 
 <span class="t-key">syncserver.koalastuff.net</span> {
-    <span class="t-key">reverse_proxy</span> <span class="t-val">localhost:3000</span>
+    <span class="t-key">import</span> <span class="t-val">security_headers</span>
+    <span class="t-key">encode</span> <span class="t-val">zstd gzip</span>
+    <span class="t-key">reverse_proxy</span> <span class="t-val">KoalaSync:3000</span>
 }</code></pre>
                     </div>
                 </div>

website/www/de/index.html

@@ -961,7 +961,24 @@
                     </div>
 
                     <div id="pane-caddy-advanced" class="terminal-pane">
-                        <pre><code><span class="t-key">sync.koalastuff.net</span> {
+                        <pre><code><span class="t-key">(security_headers)</span> {
+    <span class="t-key">header</span> {
+        <span class="t-comment"># Enable HTTP Strict Transport Security (HSTS)</span>
+        Strict-Transport-Security <span class="t-str">"max-age=31536000; includeSubDomains; preload"</span>
+        <span class="t-comment"># Prevent clickjacking attacks (Sameorigin)</span>
+        X-Frame-Options <span class="t-str">"SAMEORIGIN"</span>
+        <span class="t-comment"># Prevent MIME-sniffing</span>
+        X-Content-Type-Options <span class="t-str">"nosniff"</span>
+        <span class="t-comment"># Enable browser XSS protection</span>
+        X-XSS-Protection <span class="t-str">"1; mode=block"</span>
+        <span class="t-comment"># Control referrer information</span>
+        Referrer-Policy <span class="t-str">"strict-origin-when-cross-origin"</span>
+        <span class="t-comment"># Hide Caddy server stamp signature</span>
+        <span class="t-key">-Server</span>
+    }
+}
+
+<span class="t-key">sync.koalastuff.net</span> {
     <span class="t-key">encode</span> <span class="t-val">zstd gzip</span>
     <span class="t-key">root</span> <span class="t-val">*</span> <span class="t-str">/var/www/koalasync/website/www</span>
 
@@ -977,19 +994,17 @@
     <span class="t-key">header</span> <span class="t-val">@static</span> Cache-Control <span class="t-str">"public, max-age=31536000, must-revalidate"</span>
 
     <span class="t-comment"># Hardened Security & Permission Policies</span>
+    <span class="t-key">import</span> <span class="t-val">security_headers</span>
     <span class="t-key">header</span> {
         Content-Security-Policy <span class="t-str">"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none';"</span>
-        Strict-Transport-Security <span class="t-str">"max-age=31536000; includeSubDomains; preload"</span>
-        X-Frame-Options <span class="t-str">"DENY"</span>
-        X-Content-Type-Options <span class="t-str">"nosniff"</span>
-        Referrer-Policy <span class="t-str">"strict-origin-when-cross-origin"</span>
         Permissions-Policy <span class="t-str">"camera=(), microphone=(), geolocation=(), payment=(), usb=()"</span>
-        <span class="t-key">-Server</span>
     }
 }
 
 <span class="t-key">syncserver.koalastuff.net</span> {
-    <span class="t-key">reverse_proxy</span> <span class="t-val">localhost:3000</span>
+    <span class="t-key">import</span> <span class="t-val">security_headers</span>
+    <span class="t-key">encode</span> <span class="t-val">zstd gzip</span>
+    <span class="t-key">reverse_proxy</span> <span class="t-val">KoalaSync:3000</span>
 }</code></pre>
                     </div>
                 </div>

website/www/es/index.html

@@ -961,7 +961,24 @@
                     </div>
 
                     <div id="pane-caddy-advanced" class="terminal-pane">
-                        <pre><code><span class="t-key">sync.koalastuff.net</span> {
+                        <pre><code><span class="t-key">(security_headers)</span> {
+    <span class="t-key">header</span> {
+        <span class="t-comment"># Enable HTTP Strict Transport Security (HSTS)</span>
+        Strict-Transport-Security <span class="t-str">"max-age=31536000; includeSubDomains; preload"</span>
+        <span class="t-comment"># Prevent clickjacking attacks (Sameorigin)</span>
+        X-Frame-Options <span class="t-str">"SAMEORIGIN"</span>
+        <span class="t-comment"># Prevent MIME-sniffing</span>
+        X-Content-Type-Options <span class="t-str">"nosniff"</span>
+        <span class="t-comment"># Enable browser XSS protection</span>
+        X-XSS-Protection <span class="t-str">"1; mode=block"</span>
+        <span class="t-comment"># Control referrer information</span>
+        Referrer-Policy <span class="t-str">"strict-origin-when-cross-origin"</span>
+        <span class="t-comment"># Hide Caddy server stamp signature</span>
+        <span class="t-key">-Server</span>
+    }
+}
+
+<span class="t-key">sync.koalastuff.net</span> {
     <span class="t-key">encode</span> <span class="t-val">zstd gzip</span>
     <span class="t-key">root</span> <span class="t-val">*</span> <span class="t-str">/var/www/koalasync/website/www</span>
 
@@ -977,19 +994,17 @@
     <span class="t-key">header</span> <span class="t-val">@static</span> Cache-Control <span class="t-str">"public, max-age=31536000, must-revalidate"</span>
 
     <span class="t-comment"># Hardened Security & Permission Policies</span>
+    <span class="t-key">import</span> <span class="t-val">security_headers</span>
     <span class="t-key">header</span> {
         Content-Security-Policy <span class="t-str">"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none';"</span>
-        Strict-Transport-Security <span class="t-str">"max-age=31536000; includeSubDomains; preload"</span>
-        X-Frame-Options <span class="t-str">"DENY"</span>
-        X-Content-Type-Options <span class="t-str">"nosniff"</span>
-        Referrer-Policy <span class="t-str">"strict-origin-when-cross-origin"</span>
         Permissions-Policy <span class="t-str">"camera=(), microphone=(), geolocation=(), payment=(), usb=()"</span>
-        <span class="t-key">-Server</span>
     }
 }
 
 <span class="t-key">syncserver.koalastuff.net</span> {
-    <span class="t-key">reverse_proxy</span> <span class="t-val">localhost:3000</span>
+    <span class="t-key">import</span> <span class="t-val">security_headers</span>
+    <span class="t-key">encode</span> <span class="t-val">zstd gzip</span>
+    <span class="t-key">reverse_proxy</span> <span class="t-val">KoalaSync:3000</span>
 }</code></pre>
                     </div>
                 </div>

website/www/fr/index.html

@@ -961,7 +961,24 @@
                     </div>
 
                     <div id="pane-caddy-advanced" class="terminal-pane">
-                        <pre><code><span class="t-key">sync.koalastuff.net</span> {
+                        <pre><code><span class="t-key">(security_headers)</span> {
+    <span class="t-key">header</span> {
+        <span class="t-comment"># Enable HTTP Strict Transport Security (HSTS)</span>
+        Strict-Transport-Security <span class="t-str">"max-age=31536000; includeSubDomains; preload"</span>
+        <span class="t-comment"># Prevent clickjacking attacks (Sameorigin)</span>
+        X-Frame-Options <span class="t-str">"SAMEORIGIN"</span>
+        <span class="t-comment"># Prevent MIME-sniffing</span>
+        X-Content-Type-Options <span class="t-str">"nosniff"</span>
+        <span class="t-comment"># Enable browser XSS protection</span>
+        X-XSS-Protection <span class="t-str">"1; mode=block"</span>
+        <span class="t-comment"># Control referrer information</span>
+        Referrer-Policy <span class="t-str">"strict-origin-when-cross-origin"</span>
+        <span class="t-comment"># Hide Caddy server stamp signature</span>
+        <span class="t-key">-Server</span>
+    }
+}
+
+<span class="t-key">sync.koalastuff.net</span> {
     <span class="t-key">encode</span> <span class="t-val">zstd gzip</span>
     <span class="t-key">root</span> <span class="t-val">*</span> <span class="t-str">/var/www/koalasync/website/www</span>
 
@@ -977,19 +994,17 @@
     <span class="t-key">header</span> <span class="t-val">@static</span> Cache-Control <span class="t-str">"public, max-age=31536000, must-revalidate"</span>
 
     <span class="t-comment"># Hardened Security & Permission Policies</span>
+    <span class="t-key">import</span> <span class="t-val">security_headers</span>
     <span class="t-key">header</span> {
         Content-Security-Policy <span class="t-str">"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none';"</span>
-        Strict-Transport-Security <span class="t-str">"max-age=31536000; includeSubDomains; preload"</span>
-        X-Frame-Options <span class="t-str">"DENY"</span>
-        X-Content-Type-Options <span class="t-str">"nosniff"</span>
-        Referrer-Policy <span class="t-str">"strict-origin-when-cross-origin"</span>
         Permissions-Policy <span class="t-str">"camera=(), microphone=(), geolocation=(), payment=(), usb=()"</span>
-        <span class="t-key">-Server</span>
     }
 }
 
 <span class="t-key">syncserver.koalastuff.net</span> {
-    <span class="t-key">reverse_proxy</span> <span class="t-val">localhost:3000</span>
+    <span class="t-key">import</span> <span class="t-val">security_headers</span>
+    <span class="t-key">encode</span> <span class="t-val">zstd gzip</span>
+    <span class="t-key">reverse_proxy</span> <span class="t-val">KoalaSync:3000</span>
 }</code></pre>
                     </div>
                 </div>

website/www/index.html

@@ -961,7 +961,24 @@
                     </div>
 
                     <div id="pane-caddy-advanced" class="terminal-pane">
-                        <pre><code><span class="t-key">sync.koalastuff.net</span> {
+                        <pre><code><span class="t-key">(security_headers)</span> {
+    <span class="t-key">header</span> {
+        <span class="t-comment"># Enable HTTP Strict Transport Security (HSTS)</span>
+        Strict-Transport-Security <span class="t-str">"max-age=31536000; includeSubDomains; preload"</span>
+        <span class="t-comment"># Prevent clickjacking attacks (Sameorigin)</span>
+        X-Frame-Options <span class="t-str">"SAMEORIGIN"</span>
+        <span class="t-comment"># Prevent MIME-sniffing</span>
+        X-Content-Type-Options <span class="t-str">"nosniff"</span>
+        <span class="t-comment"># Enable browser XSS protection</span>
+        X-XSS-Protection <span class="t-str">"1; mode=block"</span>
+        <span class="t-comment"># Control referrer information</span>
+        Referrer-Policy <span class="t-str">"strict-origin-when-cross-origin"</span>
+        <span class="t-comment"># Hide Caddy server stamp signature</span>
+        <span class="t-key">-Server</span>
+    }
+}
+
+<span class="t-key">sync.koalastuff.net</span> {
     <span class="t-key">encode</span> <span class="t-val">zstd gzip</span>
     <span class="t-key">root</span> <span class="t-val">*</span> <span class="t-str">/var/www/koalasync/website/www</span>
 
@@ -977,19 +994,17 @@
     <span class="t-key">header</span> <span class="t-val">@static</span> Cache-Control <span class="t-str">"public, max-age=31536000, must-revalidate"</span>
 
     <span class="t-comment"># Hardened Security & Permission Policies</span>
+    <span class="t-key">import</span> <span class="t-val">security_headers</span>
     <span class="t-key">header</span> {
         Content-Security-Policy <span class="t-str">"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none';"</span>
-        Strict-Transport-Security <span class="t-str">"max-age=31536000; includeSubDomains; preload"</span>
-        X-Frame-Options <span class="t-str">"DENY"</span>
-        X-Content-Type-Options <span class="t-str">"nosniff"</span>
-        Referrer-Policy <span class="t-str">"strict-origin-when-cross-origin"</span>
         Permissions-Policy <span class="t-str">"camera=(), microphone=(), geolocation=(), payment=(), usb=()"</span>
-        <span class="t-key">-Server</span>
     }
 }
 
 <span class="t-key">syncserver.koalastuff.net</span> {
-    <span class="t-key">reverse_proxy</span> <span class="t-val">localhost:3000</span>
+    <span class="t-key">import</span> <span class="t-val">security_headers</span>
+    <span class="t-key">encode</span> <span class="t-val">zstd gzip</span>
+    <span class="t-key">reverse_proxy</span> <span class="t-val">KoalaSync:3000</span>
 }</code></pre>
                     </div>
                 </div>

website/www/pt-BR/index.html

@@ -961,7 +961,24 @@
                     </div>
 
                     <div id="pane-caddy-advanced" class="terminal-pane">
-                        <pre><code><span class="t-key">sync.koalastuff.net</span> {
+                        <pre><code><span class="t-key">(security_headers)</span> {
+    <span class="t-key">header</span> {
+        <span class="t-comment"># Enable HTTP Strict Transport Security (HSTS)</span>
+        Strict-Transport-Security <span class="t-str">"max-age=31536000; includeSubDomains; preload"</span>
+        <span class="t-comment"># Prevent clickjacking attacks (Sameorigin)</span>
+        X-Frame-Options <span class="t-str">"SAMEORIGIN"</span>
+        <span class="t-comment"># Prevent MIME-sniffing</span>
+        X-Content-Type-Options <span class="t-str">"nosniff"</span>
+        <span class="t-comment"># Enable browser XSS protection</span>
+        X-XSS-Protection <span class="t-str">"1; mode=block"</span>
+        <span class="t-comment"># Control referrer information</span>
+        Referrer-Policy <span class="t-str">"strict-origin-when-cross-origin"</span>
+        <span class="t-comment"># Hide Caddy server stamp signature</span>
+        <span class="t-key">-Server</span>
+    }
+}
+
+<span class="t-key">sync.koalastuff.net</span> {
     <span class="t-key">encode</span> <span class="t-val">zstd gzip</span>
     <span class="t-key">root</span> <span class="t-val">*</span> <span class="t-str">/var/www/koalasync/website/www</span>
 
@@ -977,19 +994,17 @@
     <span class="t-key">header</span> <span class="t-val">@static</span> Cache-Control <span class="t-str">"public, max-age=31536000, must-revalidate"</span>
 
     <span class="t-comment"># Hardened Security & Permission Policies</span>
+    <span class="t-key">import</span> <span class="t-val">security_headers</span>
     <span class="t-key">header</span> {
         Content-Security-Policy <span class="t-str">"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none';"</span>
-        Strict-Transport-Security <span class="t-str">"max-age=31536000; includeSubDomains; preload"</span>
-        X-Frame-Options <span class="t-str">"DENY"</span>
-        X-Content-Type-Options <span class="t-str">"nosniff"</span>
-        Referrer-Policy <span class="t-str">"strict-origin-when-cross-origin"</span>
         Permissions-Policy <span class="t-str">"camera=(), microphone=(), geolocation=(), payment=(), usb=()"</span>
-        <span class="t-key">-Server</span>
     }
 }
 
 <span class="t-key">syncserver.koalastuff.net</span> {
-    <span class="t-key">reverse_proxy</span> <span class="t-val">localhost:3000</span>
+    <span class="t-key">import</span> <span class="t-val">security_headers</span>
+    <span class="t-key">encode</span> <span class="t-val">zstd gzip</span>
+    <span class="t-key">reverse_proxy</span> <span class="t-val">KoalaSync:3000</span>
 }</code></pre>
                     </div>
                 </div>

website/www/ru/index.html

@@ -961,7 +961,24 @@
                     </div>
 
                     <div id="pane-caddy-advanced" class="terminal-pane">
-                        <pre><code><span class="t-key">sync.koalastuff.net</span> {
+                        <pre><code><span class="t-key">(security_headers)</span> {
+    <span class="t-key">header</span> {
+        <span class="t-comment"># Enable HTTP Strict Transport Security (HSTS)</span>
+        Strict-Transport-Security <span class="t-str">"max-age=31536000; includeSubDomains; preload"</span>
+        <span class="t-comment"># Prevent clickjacking attacks (Sameorigin)</span>
+        X-Frame-Options <span class="t-str">"SAMEORIGIN"</span>
+        <span class="t-comment"># Prevent MIME-sniffing</span>
+        X-Content-Type-Options <span class="t-str">"nosniff"</span>
+        <span class="t-comment"># Enable browser XSS protection</span>
+        X-XSS-Protection <span class="t-str">"1; mode=block"</span>
+        <span class="t-comment"># Control referrer information</span>
+        Referrer-Policy <span class="t-str">"strict-origin-when-cross-origin"</span>
+        <span class="t-comment"># Hide Caddy server stamp signature</span>
+        <span class="t-key">-Server</span>
+    }
+}
+
+<span class="t-key">sync.koalastuff.net</span> {
     <span class="t-key">encode</span> <span class="t-val">zstd gzip</span>
     <span class="t-key">root</span> <span class="t-val">*</span> <span class="t-str">/var/www/koalasync/website/www</span>
 
@@ -977,19 +994,17 @@
     <span class="t-key">header</span> <span class="t-val">@static</span> Cache-Control <span class="t-str">"public, max-age=31536000, must-revalidate"</span>
 
     <span class="t-comment"># Hardened Security & Permission Policies</span>
+    <span class="t-key">import</span> <span class="t-val">security_headers</span>
     <span class="t-key">header</span> {
         Content-Security-Policy <span class="t-str">"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none';"</span>
-        Strict-Transport-Security <span class="t-str">"max-age=31536000; includeSubDomains; preload"</span>
-        X-Frame-Options <span class="t-str">"DENY"</span>
-        X-Content-Type-Options <span class="t-str">"nosniff"</span>
-        Referrer-Policy <span class="t-str">"strict-origin-when-cross-origin"</span>
         Permissions-Policy <span class="t-str">"camera=(), microphone=(), geolocation=(), payment=(), usb=()"</span>
-        <span class="t-key">-Server</span>
     }
 }
 
 <span class="t-key">syncserver.koalastuff.net</span> {
-    <span class="t-key">reverse_proxy</span> <span class="t-val">localhost:3000</span>
+    <span class="t-key">import</span> <span class="t-val">security_headers</span>
+    <span class="t-key">encode</span> <span class="t-val">zstd gzip</span>
+    <span class="t-key">reverse_proxy</span> <span class="t-val">KoalaSync:3000</span>
 }</code></pre>
                     </div>
                 </div>