Josep Piguillem
7e672a5e62
The Content-Security-Policy meant for stored SVGs never applied: in Caddy a `*` in the middle of a path does not cross a `/`, so `path /storage/*.svg` only matched files directly under /storage, and every upload lives in a directory below it. Two matchers, which Caddy ANDs, cover any depth. RemoteImage fetched with Guzzle's anonymous default User-Agent, which Wikimedia answers with 403. It now sends `<app>/1.0 (+<app url>; media fetcher)`, the identification such hosts ask of automated clients. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
69 lines
2.0 KiB
Caddyfile
69 lines
2.0 KiB
Caddyfile
{
|
|
# The panel is the only thing served, and it is behind a login: no reason
|
|
# for the server to announce its version to anybody scanning.
|
|
frankenphp
|
|
order php_server before file_server
|
|
auto_https off
|
|
servers {
|
|
trusted_proxies static private_ranges
|
|
}
|
|
}
|
|
|
|
{$SERVER_NAME:-:80} {
|
|
root * /app/public
|
|
|
|
encode zstd gzip
|
|
|
|
# Uploaded images. `public/storage` is a symlink into the storage volume,
|
|
# so this is what actually serves what the collective uploads — and it is
|
|
# the one path an SSR frontend fetches on every page view, so it is cached
|
|
# hard and never touched by PHP.
|
|
@media path /storage/*
|
|
header @media Cache-Control "public, max-age=31536000, immutable"
|
|
|
|
# Uploaded SVGs are sanitized on the way in (MediaController). This is the
|
|
# second line: opened directly rather than through an <img>, an SVG is a
|
|
# document, and nothing stored here has any business running script or
|
|
# loading anything from elsewhere.
|
|
#
|
|
# Two matchers, which Caddy ANDs, rather than `path /storage/*.svg`: a `*`
|
|
# in the middle of a path does not cross a `/`, so that pattern only ever
|
|
# matched files directly under /storage — and every upload is a directory
|
|
# below it.
|
|
@svg {
|
|
path /storage/*
|
|
path_regexp (?i)\.svg$
|
|
}
|
|
header @svg Content-Security-Policy "default-src 'none'; style-src 'unsafe-inline'; img-src data:"
|
|
|
|
# The frontend is a separate application on another origin.
|
|
@api path /api/*
|
|
header @api {
|
|
X-Content-Type-Options nosniff
|
|
}
|
|
|
|
header {
|
|
X-Content-Type-Options nosniff
|
|
X-Frame-Options SAMEORIGIN
|
|
Referrer-Policy strict-origin-when-cross-origin
|
|
-Server
|
|
}
|
|
|
|
php_server {
|
|
# Laravel's own health route, so the container can be probed without
|
|
# touching the database.
|
|
try_files {path} /index.php
|
|
}
|
|
|
|
# The health probe runs every 30 seconds and would otherwise be most of
|
|
# the access log. `log_skip` is the directive for this — `exclude` inside
|
|
# `log` is not valid in Caddy 2.
|
|
@health path /up
|
|
log_skip @health
|
|
|
|
log {
|
|
output stdout
|
|
format json
|
|
}
|
|
}
|