mirror of
https://github.com/Shik3i/KoalaSync.git
synced 2026-07-26 12:08:15 +00:00
Koala
1b04db009a
PageSpeed Insights flagged AVIF files as uncached because the @static matcher only included *.webp. Adding *.avif enables 1-year Cache-Control for all AVIF assets.
84 lines
3.1 KiB
Caddyfile
84 lines
3.1 KiB
Caddyfile
# ==============================================================================
|
|
# KoalaSync - Production Caddy Configuration Example
|
|
# ==============================================================================
|
|
# This file provides examples of both a lightweight "Simple" configuration
|
|
# and a production-hardened "Advanced" configuration.
|
|
# Replace domains, reverse proxy locations, and directories with your actual setup.
|
|
|
|
# ------------------------------------------------------------------------------
|
|
# OPTION A: Simple Configuration
|
|
# ------------------------------------------------------------------------------
|
|
# Minimal configuration that serves the static website, enables gzip compression,
|
|
# supports extension-less Clean URLs, and reverse proxies the relay server.
|
|
|
|
# sync.koalastuff.net {
|
|
# root * /var/www/koalasync/website/www
|
|
# encode zstd gzip
|
|
#
|
|
# # Clean URLs support (resolves /join to join.html, etc.)
|
|
# try_files {path} {path}.html {path}/
|
|
# file_server
|
|
# }
|
|
#
|
|
# syncserver.koalastuff.net {
|
|
# reverse_proxy localhost:3000
|
|
# }
|
|
|
|
|
|
# ------------------------------------------------------------------------------
|
|
# OPTION B: Advanced Configuration (Production-Hardened)
|
|
# ------------------------------------------------------------------------------
|
|
# Highly secure, optimized configuration using advanced HTTP security headers,
|
|
# aggressive static assets caching, server signature concealment, and strict
|
|
# hardware permission access policies.
|
|
|
|
(security_headers) {
|
|
header {
|
|
# Enable HTTP Strict Transport Security (HSTS)
|
|
Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
|
|
# Prevent clickjacking attacks (Sameorigin)
|
|
X-Frame-Options "SAMEORIGIN"
|
|
# Prevent MIME-sniffing
|
|
X-Content-Type-Options "nosniff"
|
|
# Enable browser XSS protection
|
|
X-XSS-Protection "1; mode=block"
|
|
# Control referrer information
|
|
Referrer-Policy "strict-origin-when-cross-origin"
|
|
# Hide Caddy server stamp signature
|
|
-Server
|
|
}
|
|
}
|
|
|
|
sync.koalastuff.net {
|
|
encode zstd gzip
|
|
root * /var/www/koalasync/website/www
|
|
|
|
# Clean URLs: Resolves paths without .html in the URL
|
|
try_files {path} {path}.html {path}/
|
|
file_server
|
|
|
|
# Static Caching for high-performance PageSpeed (1 year with validation)
|
|
@static {
|
|
file
|
|
path *.ico *.css *.js *.png *.svg *.webp *.avif
|
|
}
|
|
header @static Cache-Control "public, max-age=31536000, must-revalidate"
|
|
|
|
# Security Headers & Content Security Policy (CSP)
|
|
import security_headers
|
|
header {
|
|
# CSP hardened with base-uri and form-action limits
|
|
Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none';"
|
|
|
|
# Modern Permissions Policy (blocks browser hardware access for enhanced privacy)
|
|
Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()"
|
|
}
|
|
}
|
|
|
|
syncserver.koalastuff.net {
|
|
import security_headers
|
|
encode zstd gzip
|
|
reverse_proxy KoalaSync:3000
|
|
}
|
|
|