Timmy
f8f01c4b2e
All checks were successful
Quality gates / quality (pull_request) Successful in 1m28s
37 lines
1.1 KiB
Caddyfile
37 lines
1.1 KiB
Caddyfile
# Example complete site used for validation. Merge only the reviewed handles into
|
|
# the existing forge site. Route order is security-sensitive.
|
|
forge.example.invalid {
|
|
encode zstd gzip
|
|
|
|
@git path /git /git/*
|
|
handle @git {
|
|
reverse_proxy 127.0.0.1:3000
|
|
}
|
|
|
|
handle_path /timmy-staging/* {
|
|
basic_auth {
|
|
staging {$TIMMY_STAGING_PASSWORD_HASH}
|
|
}
|
|
request_body {
|
|
max_size 8MB
|
|
}
|
|
header {
|
|
X-Content-Type-Options "nosniff"
|
|
X-Frame-Options "DENY"
|
|
Referrer-Policy "no-referrer"
|
|
Permissions-Policy "camera=(self), microphone=(), geolocation=()"
|
|
Content-Security-Policy "default-src 'self'; img-src 'self' data: blob:; style-src 'self'; script-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'"
|
|
-Server
|
|
}
|
|
# handle_path strips the public prefix exactly once. Reconstruct it for
|
|
# Timmy because its validated base-path router must see that same prefix.
|
|
rewrite * /timmy-staging{uri}
|
|
reverse_proxy 127.0.0.1:4174
|
|
}
|
|
|
|
# Existing Gitea catchall belongs after the private staging route.
|
|
handle {
|
|
reverse_proxy 127.0.0.1:3000
|
|
}
|
|
}
|