# ==============================================================================
# KoalaSync - Production Caddy Configuration Example
# ==============================================================================
# This file provides examples of both a lightweight "Simple" configuration 
# and a production-hardened "Advanced" configuration.
# Replace domains, reverse proxy locations, and directories with your actual setup.

# ------------------------------------------------------------------------------
# OPTION A: Simple Configuration
# ------------------------------------------------------------------------------
# Minimal configuration that serves the static website, enables gzip compression,
# supports extension-less Clean URLs, and reverse proxies the relay server.

# sync.koalastuff.net {
#     root * /var/www/koalasync/website/www
#     encode zstd gzip
#
#     # Clean URLs support (resolves /join to join.html, etc.)
#     try_files {path} {path}.html {path}/
#     file_server
# }
#
# syncserver.koalastuff.net {
#     reverse_proxy localhost:3000
# }


# ------------------------------------------------------------------------------
# OPTION B: Advanced Configuration (Production-Hardened)
# ------------------------------------------------------------------------------
# Highly secure, optimized configuration using advanced HTTP security headers,
# aggressive static assets caching, server signature concealment, and strict 
# hardware permission access policies.

sync.koalastuff.net {
    encode zstd gzip
    root * /var/www/koalasync/website/www

    # Clean URLs: Resolves paths without .html in the URL
    try_files {path} {path}.html {path}/
    file_server

    # Static Caching for high-performance PageSpeed (1 year with validation)
    @static {
        file
        path *.ico *.css *.js *.png *.svg *.webp
    }
    header @static Cache-Control "public, max-age=31536000, must-revalidate"

    # Security Headers & Content Security Policy (CSP)
    header {
        # CSP hardened with base-uri and form-action limits
        Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none';"
        
        # Strict Transport Security (HSTS)
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        
        # Security best practices
        X-Frame-Options "DENY"
        X-Content-Type-Options "nosniff"
        Referrer-Policy "strict-origin-when-cross-origin"
        
        # Modern Permissions Policy (blocks browser hardware access for enhanced privacy)
        Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()"
        
        # Remove Caddy's server stamp signature
        -Server
    }
}

syncserver.koalastuff.net {
    reverse_proxy localhost:3000 {
        header_up Host {host}
        header_up X-Real-IP {remote_host}
    }

    header {
        X-Content-Type-Options "nosniff"
        X-Frame-Options "DENY"
        Referrer-Policy "strict-origin-when-cross-origin"
        -Server
    }
}