155 lines
4.3 KiB
Caddyfile
155 lines
4.3 KiB
Caddyfile
(auth) {
|
|
basicauth {
|
|
admin $2a$14$DahHUWD2cKyXJ96sH5VQwuQv1bqmIn0gsdoSaw4mofzfdNY2Y0VsO
|
|
}
|
|
}
|
|
|
|
(common) {
|
|
encode gzip zstd
|
|
header {
|
|
Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
|
|
X-Content-Type-Options "nosniff"
|
|
X-Frame-Options "DENY"
|
|
Referrer-Policy "strict-origin-when-cross-origin"
|
|
Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=()"
|
|
Cross-Origin-Opener-Policy "same-origin"
|
|
Cross-Origin-Resource-Policy "same-origin"
|
|
Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:"
|
|
}
|
|
|
|
# Blockera kända skadliga sökvägar för alla domäner
|
|
@blocked path_regexp ^/(\.env|\.git(/.*)?|\.well-known/acme-challenge/.*\.php|wp-login.*|wp-admin(/.*)?|wp-includes(/.*)?|wp-content(/.*)?|xmlrpc\.php|xmrlpc\.php|api/graphql|actuator/env|\.DS_Store|cgi-bin(/.*)?|vendor/|telescope|debug|info\.php|config\.json|[a-zA-Z0-9_-]{1,12}\.php|class-.*\.php|whs.*\.php|wp-.*\.php)$
|
|
respond @blocked 403
|
|
|
|
# Blockera kända botar
|
|
@blocked_bots header_regexp User-Agent (scanhawk|leakix|CensysInspect|l9scan|sqlmap|Nikto|DirBuster|OpenAI-SearchBot|oai-searchbot|GitFinder|RootEvidence|zgrab|masscan|nuclei)
|
|
respond @blocked_bots 403
|
|
|
|
# Svara på robots.txt istället för 403
|
|
@robots path /robots.txt
|
|
respond @robots "User-agent: *\nDisallow: /" 200
|
|
}
|
|
|
|
test.gynther.se {
|
|
import auth
|
|
import common
|
|
# Samma Flutter-anpassade CSP som recept.gynther.se
|
|
header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' https://www.gstatic.com; connect-src 'self' https://www.gstatic.com https://fonts.gstatic.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob:"
|
|
reverse_proxy recipe-flutter:5000
|
|
}
|
|
|
|
nzbget.gynther.se {
|
|
import common
|
|
reverse_proxy http://192.168.50.4:6789
|
|
}
|
|
|
|
prowlarr.gynther.se {
|
|
import common
|
|
reverse_proxy http://prowlarr:9696
|
|
}
|
|
|
|
radarr.gynther.se {
|
|
import common
|
|
reverse_proxy http://radarr:7878
|
|
}
|
|
|
|
sonarr.gynther.se {
|
|
import common
|
|
reverse_proxy http://sonarr:8989
|
|
}
|
|
|
|
jellyfin.gynther.se {
|
|
import common
|
|
reverse_proxy http://jellyfin:8096
|
|
}
|
|
|
|
qbittorrent.gynther.se {
|
|
import common
|
|
reverse_proxy 192.168.50.4:8080
|
|
}
|
|
|
|
wetty.gynther.se {
|
|
import auth
|
|
import common
|
|
redir / /wetty
|
|
reverse_proxy wetty:3003
|
|
}
|
|
|
|
gitea.gynther.se {
|
|
import common
|
|
reverse_proxy 192.168.50.2:3002
|
|
}
|
|
|
|
# ============================================
|
|
# Import Service (Document Converter) - Standalone UI
|
|
# ============================================
|
|
import.gynther.se {
|
|
import common
|
|
|
|
# Lägg till en standard-sida för /
|
|
handle / {
|
|
respond "Welcome to Import Service" 200
|
|
}
|
|
|
|
reverse_proxy importer-api:3001
|
|
}
|
|
|
|
# ============================================
|
|
# RECIPE APP + IMPORT SERVICE
|
|
# ============================================
|
|
recept.gynther.se {
|
|
import common
|
|
|
|
# Flutter Web (CanvasKit) kräver script/wasm/fonter från gstatic.com.
|
|
# Skriver över den strikta CSP:n från (common).
|
|
header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' https://www.gstatic.com; connect-src 'self' https://www.gstatic.com https://fonts.gstatic.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob:"
|
|
|
|
# === IMPORT SERVICE (Document Converter) ===
|
|
# Dessa endpoints måste komma FÖRST innan backend reglerna!
|
|
handle /api/recipes/import* {
|
|
reverse_proxy importer-api:3001
|
|
}
|
|
|
|
# === RECIPE FRONTEND PROXY ENDPOINTS ===
|
|
# Next.js API routes
|
|
handle /api/inventory-history-proxy {
|
|
reverse_proxy recipe-flutter:5000
|
|
}
|
|
|
|
handle /api/admin/merge-preview-proxy {
|
|
reverse_proxy recipe-flutter:5000
|
|
}
|
|
|
|
handle /api/recipe-preview-proxy {
|
|
reverse_proxy recipe-flutter:5000
|
|
}
|
|
|
|
# === RECIPE BACKEND API ENDPOINTS ===
|
|
# Backend körs på port 8080 (från docker-compose)
|
|
handle /api/products* {
|
|
reverse_proxy recipe-api:8080
|
|
}
|
|
|
|
handle /api/inventory* {
|
|
reverse_proxy recipe-api:8080
|
|
}
|
|
|
|
handle /api/recipes* {
|
|
reverse_proxy recipe-api:8080
|
|
}
|
|
|
|
# === HEALTH CHECKS ===
|
|
handle /health {
|
|
reverse_proxy recipe-api:8080
|
|
}
|
|
|
|
# === CATCH ALL ===
|
|
# Övriga /api/* går till frontend
|
|
handle /api/* {
|
|
reverse_proxy recipe-flutter:5000
|
|
}
|
|
|
|
# Frontend - catch all remaining routes (port 5000)
|
|
reverse_proxy /* recipe-flutter:5000
|
|
}
|