# ==============================================================================
# KoalaSync - Production Caddy Configuration Example
# ==============================================================================
# This file provides examples of both a lightweight "Simple" configuration 
# and a production-hardened "Advanced" configuration.
# Replace domains, reverse proxy locations, and directories with your actual setup.

# ------------------------------------------------------------------------------
# OPTION A: Simple Configuration
# ------------------------------------------------------------------------------
# Minimal configuration that serves the static website, enables gzip compression,
# supports extension-less Clean URLs, and reverse proxies the relay server.

# sync.koalastuff.net {
#     root * /var/www/koalasync/website/www
#     encode zstd gzip
#
#     # Clean URLs support (resolves /join to join.html, etc.)
#     try_files {path} {path}.html {path}/
#     file_server
# }
#
# syncserver.koalastuff.net {
#     reverse_proxy localhost:3000
# }


# ------------------------------------------------------------------------------
# OPTION B: Advanced Configuration (Production-Hardened)
# ------------------------------------------------------------------------------
# Highly secure, optimized configuration using advanced HTTP security headers,
# aggressive static assets caching, server signature concealment, and strict 
# hardware permission access policies.

(security_headers) {
	header {
		# Enable HTTP Strict Transport Security (HSTS)
		Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
		# Prevent clickjacking attacks (Sameorigin)
		X-Frame-Options "SAMEORIGIN"
		# Prevent MIME-sniffing
		X-Content-Type-Options "nosniff"
		# Enable browser XSS protection
		X-XSS-Protection "1; mode=block"
		# Control referrer information
		Referrer-Policy "strict-origin-when-cross-origin"
		# Hide Caddy server stamp signature
		-Server
	}
}

sync.koalastuff.net {
    encode zstd gzip
    root * /var/www/koalasync/website/www

    # Clean URLs: Resolves paths without .html in the URL
    try_files {path} {path}.html {path}/
    file_server

    # Static Caching for high-performance PageSpeed (1 year with validation)
    @static {
        file
        path *.ico *.css *.js *.png *.svg *.webp *.avif
    }
    header @static Cache-Control "public, max-age=31536000, must-revalidate"

    # Security Headers & Content Security Policy (CSP)
    import security_headers
    header {
        # CSP hardened with base-uri and form-action limits
        Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none';"
        
        # Modern Permissions Policy (blocks browser hardware access for enhanced privacy)
        Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()"
    }
}

syncserver.koalastuff.net {
	import security_headers
	encode zstd gzip
	reverse_proxy KoalaSync:3000
}