Caddyfile.example

# Caddyfile Example for StreamPlatformLite
# Copy this file to 'Caddyfile' and replace 'example.com' with your actual domain

# Global options
{
    # Disable admin API — in Docker, all containers share the same internal network,
    # so the default localhost:2019 admin endpoint is reachable from other containers.
    # Only enable if you need dynamic config reloads, and restrict access accordingly.
    admin off
}

# Security headers snippet — applied to every response via 'import security_headers'
(security_headers) {
    header {
        X-Frame-Options "DENY"
        X-Content-Type-Options "nosniff"
        X-XSS-Protection "1; mode=block"
        Referrer-Policy "strict-origin-when-cross-origin"
        Permissions-Policy "geolocation=(), microphone=(), camera=()"
        Strict-Transport-Security "max-age=31536000; includeSubDomains"
        -Server
        -X-Powered-By
    }
}

# Replace 'example.com' with your domain name
example.com {
    # Automatically obtain and renew SSL certificates from Let's Encrypt
    # No manual certificate management needed!

    # Enable access logging
    log {
        output file /var/log/caddy/access.log
        format json
    }

    # Enable compression
    encode gzip zstd

    # Reverse proxy for auth requests (with URL rewriting)
    handle /auth/* {
        uri strip_prefix /auth
        reverse_proxy core-service:8081 {
            header_up X-Forwarded-Proto {scheme}
        }
        import security_headers
    }

    # Reverse proxy for API requests (with URL rewriting)
    handle /api/* {
        # Remove /api prefix before forwarding to backend
        uri strip_prefix /api
        reverse_proxy go-service:8080 {
            # Forward real client IP
            header_up X-Real-IP {remote_host}
            header_up X-Forwarded-For {remote_host}
            header_up X-Forwarded-Proto {scheme}

            # Strip upstream static headers to prevent duplicates
            # Content-Security-Policy is intentionally preserved (backend has API CSP)
            header_down -X-Frame-Options
            header_down -X-Content-Type-Options
            header_down -X-XSS-Protection
            header_down -Referrer-Policy
            header_down -Permissions-Policy
            header_down -Strict-Transport-Security
        }
        import security_headers
    }

    # Reverse proxy for frontend (all other requests)
    handle {
        reverse_proxy frontend:3000 {
            # Forward real client IP
            header_up X-Real-IP {remote_host}
            header_up X-Forwarded-For {remote_host}
            header_up X-Forwarded-Proto {scheme}

            # Strip all upstream security headers; Caddy is the single source of truth
            header_down -X-Frame-Options
            header_down -X-Content-Type-Options
            header_down -X-XSS-Protection
            header_down -Referrer-Policy
            header_down -Permissions-Policy
            header_down -Strict-Transport-Security
            header_down -Content-Security-Policy
        }
        # SPA CSP:
        #   script-src 'unsafe-inline'  — pre-built SPA has no per-request nonce
        #   blob:                        — HLS.js Web Worker + MSE video segments
        #   style-src 'unsafe-inline'   — runtime CSS injection (headlessui, plyr, etc.)
        #   style-src-attr 'none'       — blocks CSS if()-based exfiltration (PortSwigger 2025)
        #   img-src cdn.discordapp.com  — Discord user avatars
        #   media-src blob:             — HLS video segments
        header Content-Security-Policy "default-src 'self'; script-src 'self' blob: 'unsafe-inline'; style-src 'self' 'unsafe-inline'; style-src-attr 'none'; img-src 'self' https://cdn.discordapp.com data:; media-src 'self' blob:; font-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';"
        import security_headers
    }
}

# Optional: Redirect www to non-www (uncomment if needed)
# www.example.com {
#     redir https://example.com{uri} permanent
# }

# Advanced Configuration Examples (commented out by default):

# Example 1: Using custom SSL certificates (e.g., Cloudflare Origin CA)
# Uncomment and modify if you want to use your own certificates instead of Let's Encrypt
# example.com {
#     tls /etc/caddy/certs/cloudflare.pem /etc/caddy/certs/cloudflare.key
#
#     # ... (same configuration as above)
# }

# Example 2: Using Cloudflare DNS for automatic HTTPS (supports wildcard certificates)
# Requires: Caddy with Cloudflare DNS plugin
# Uncomment and add your Cloudflare API token
# example.com {
#     tls {
#         dns cloudflare {env.CLOUDFLARE_API_TOKEN}
#     }
#
#     # ... (same configuration as above)
# }

# Example 3: Multiple domains
# example.com, www.example.com, another-domain.com {
#     # ... (same configuration)
# }