64 lines
1.4 KiB
Caddyfile
64 lines
1.4 KiB
Caddyfile
# Caddy config. Environment variables are supplied via the quadlet EnvironmentFile
|
|
# (deploy/quadlets/caddy.container -> secrets/caddy.env):
|
|
# DOMAIN, ACME_EMAIL, GCP_PROJECT, BACKEND_UPSTREAM, GOOGLE_APPLICATION_CREDENTIALS
|
|
{
|
|
order coraza_waf first
|
|
email {$ACME_EMAIL}
|
|
}
|
|
|
|
{$DOMAIN} {
|
|
# TLS via ACME DNS-01 using Google Cloud DNS (supports wildcards, no inbound :80 needed).
|
|
tls {
|
|
dns googleclouddns {
|
|
gcp_project {$GCP_PROJECT}
|
|
}
|
|
resolvers 8.8.8.8 1.1.1.1
|
|
}
|
|
|
|
log {
|
|
output file /var/log/caddy/access.log {
|
|
roll_size 20MiB
|
|
roll_keep 10
|
|
}
|
|
format json
|
|
}
|
|
|
|
encode zstd gzip
|
|
|
|
# Web Application Firewall (OWASP CRS). Runs first for every request.
|
|
coraza_waf {
|
|
directives `
|
|
Include /etc/caddy/coraza/coraza.conf
|
|
Include /etc/caddy/coraza/coreruleset/crs-setup.conf
|
|
Include /etc/caddy/coraza/coreruleset/rules/*.conf
|
|
SecRuleEngine On
|
|
`
|
|
}
|
|
|
|
# API + health proxied to the Go backend (Caddy active-health-checks the upstream).
|
|
@api path /api/* /healthz
|
|
handle @api {
|
|
reverse_proxy {$BACKEND_UPSTREAM} {
|
|
health_uri /healthz
|
|
health_interval 15s
|
|
health_timeout 5s
|
|
}
|
|
}
|
|
|
|
# Static SPA; unknown routes fall back to index.html.
|
|
handle {
|
|
root * /srv/www
|
|
try_files {path} /index.html
|
|
file_server
|
|
}
|
|
|
|
header {
|
|
Strict-Transport-Security "max-age=31536000; includeSubDomains"
|
|
X-Content-Type-Options nosniff
|
|
X-Frame-Options DENY
|
|
Referrer-Policy strict-origin-when-cross-origin
|
|
-Server
|
|
}
|
|
}
|