Caddyfile

# SPDX-License-Identifier: AGPL-3.0-or-later
# SPDX-FileCopyrightText: 2024 JWP Consulting GK
{
	admin off
}
# Helpful links for Caddy security headers
# https://github.com/jpcaparas/caddy-csp/blob/f241472610a5a4e4f8d74e0976120bbb2cca84cc/Caddyfile
# https://paulbradley.dev/caddyfile-web-security-headers/
(frontend_headers) {
	# We need to relax the CSP a bit, since Svelte has some inline js.
	# Compared to backend_headers, we removed default-src and script-src
	# Furthermore, we have to make sure we don't override any CSP headers
	# Should SvelteKit with adapter-node decide to return a header itself
	# We have to relax style-src here as well, in case of a page transition
	# from landing (prerendered) to dashboard (ssr/csr)
	# Refer to
	# See https://github.com/sveltejs/kit/issues/11747 and
	# https://kit.svelte.dev/docs/configuration
	header ?Content-Security-Policy "
		style-src 'self' 'unsafe-inline';
		font-src 'self';
		img-src 'self' blob: res.cloudinary.com;
		form-action 'self';
		connect-src 'self';
		frame-ancestors 'none';
		object-src 'self';
		base-uri 'self';
	"
}
(backend_headers) {
	# The backend is locked down more
	header {
		Content-Security-Policy "
			default-src 'self';
			style-src 'self';
			script-src 'self';
			font-src 'self';
			img-src 'self' res.cloudinary.com;
			form-action 'self';
			connect-src 'self';
			frame-ancestors 'none';
			object-src 'self';
			base-uri 'self';
		"
		# TODO add default-src 'none', at least as a report directive
	}
}

# The additional host requires setting the port within the variable.
# The idea is to avoid accidentally leaving out $ADDITIONAL_HOST and then
# having a stranded ":" there, if we instead write
# {$ADDITIONAL_HOST}:{$ADDITIONAL_PORT}
{$HOST:invalid}:{$PORT:invalid} {$ADDITIONAL_HOST} {
	header {
		X-Frame-Options DENY
		Strict-Transport-Security "max-age=15768000; includeSubDomains; preload"
		X-Content-Type-Options nosniff
	}
	handle /admin/* {
		import backend_headers
		reverse_proxy {$BACKEND_HOST}:{$BACKEND_PORT}
	}
	handle /static/django/* {
		import backend_headers
		reverse_proxy {$BACKEND_HOST}:{$BACKEND_PORT}
	}
	handle /ws/* {
		import backend_headers
		reverse_proxy {$BACKEND_HOST}:{$BACKEND_PORT}
	}
	handle_path /api/* {
		import backend_headers
		reverse_proxy {$BACKEND_HOST}:{$BACKEND_PORT}
	}
	handle /* {
		import frontend_headers
		reverse_proxy {$FRONTEND_HOST}:{$FRONTEND_PORT}
	}
}