43 lines
904 B
Caddyfile
43 lines
904 B
Caddyfile
# Wird von setup-lxc.sh gerendert, nicht direkt verwenden.
|
|
# Caddy terminiert TLS; die App setzt Secure-Cookies (CHECKBOT_SECURE_COOKIES=1) und bindet nur an localhost.
|
|
|
|
@@FQDN@@ {
|
|
@@TLS_DIRECTIVE@@
|
|
|
|
encode zstd gzip
|
|
|
|
request_body {
|
|
max_size 1MB
|
|
}
|
|
|
|
header {
|
|
Strict-Transport-Security "max-age=31536000"
|
|
-Server
|
|
}
|
|
|
|
# Keine Query-Strings, Authorization- oder Cookie-Header im Zugriffslog.
|
|
log {
|
|
output stderr
|
|
format filter {
|
|
wrap json
|
|
fields {
|
|
request>uri regexp `\?.*` ""
|
|
request>headers>Authorization delete
|
|
request>headers>Cookie delete
|
|
resp_headers>Set-Cookie delete
|
|
}
|
|
}
|
|
}
|
|
|
|
# /health enthält interne Detailtexte, daher nur lokal und vom Monitoring-Server.
|
|
@health_denied {
|
|
path /health /health/*
|
|
not remote_ip 127.0.0.1 ::1 @@HEALTH_IPS@@
|
|
}
|
|
respond @health_denied "Zugriff verweigert" 403
|
|
|
|
reverse_proxy @@UPSTREAM@@ {
|
|
header_down -Server
|
|
}
|
|
}
|