77 lines
1.6 KiB
Caddyfile
77 lines
1.6 KiB
Caddyfile
# TLS termination and reverse proxy for the coordinator.
|
|
# Caddy obtains and renews the Let's Encrypt certificate automatically
|
|
# (needs public ports 80 and 443). install.sh substitutes the hostname.
|
|
{
|
|
admin off
|
|
# The ACME account: expiry notices, and ZeroSSL (the fallback issuer) requires one.
|
|
email admin@clank.rodecomp.online
|
|
}
|
|
|
|
clank.rodecomp.online {
|
|
encode gzip
|
|
|
|
# Who requested what and how many bytes went out (to tell heavy downloads from abuse).
|
|
log {
|
|
output file /var/log/caddy/access.log {
|
|
roll_size 50MiB
|
|
roll_keep 5
|
|
}
|
|
format json
|
|
}
|
|
|
|
header {
|
|
Strict-Transport-Security "max-age=31536000"
|
|
X-Content-Type-Options "nosniff"
|
|
X-Frame-Options "DENY"
|
|
Referrer-Policy "no-referrer"
|
|
Permissions-Policy "interest-cohort=()"
|
|
-Server
|
|
}
|
|
|
|
request_body {
|
|
max_size 8MB
|
|
}
|
|
|
|
# Git dashboard (Forgejo), configured with ROOT_URL https://<host>/git/.
|
|
redir /git /git/ 308
|
|
handle_path /git/* {
|
|
reverse_proxy 127.0.0.1:3000
|
|
}
|
|
|
|
handle {
|
|
reverse_proxy 127.0.0.1:8080
|
|
}
|
|
}
|
|
|
|
|
|
# The test instance (togetherdecomp-test, deploy with tools/deploy.sh --test): its own coordinator
|
|
# and data; changes are tried here before they go to the main site.
|
|
test.clank.rodecomp.online {
|
|
encode gzip
|
|
|
|
log {
|
|
output file /var/log/caddy/test-access.log {
|
|
roll_size 50MiB
|
|
roll_keep 3
|
|
}
|
|
format json
|
|
}
|
|
|
|
header {
|
|
Strict-Transport-Security "max-age=31536000"
|
|
X-Content-Type-Options "nosniff"
|
|
X-Frame-Options "DENY"
|
|
Referrer-Policy "no-referrer"
|
|
Permissions-Policy "interest-cohort=()"
|
|
-Server
|
|
}
|
|
|
|
request_body {
|
|
max_size 8MB
|
|
}
|
|
|
|
handle {
|
|
reverse_proxy 127.0.0.1:8090
|
|
}
|
|
}
|