Open Source Release
38 lines
1.3 KiB
Caddyfile
38 lines
1.3 KiB
Caddyfile
:80 {
|
|
root * /srv
|
|
encode gzip
|
|
|
|
# Browsers ignore Strict-Transport-Security on a plain-HTTP connection,
|
|
# so this is a no-op today and becomes effective the moment TLS is
|
|
# terminated in front of this service (host-level Caddy once a domain
|
|
# is chosen — see this repo's docker-compose.yml comment on core's
|
|
# equivalent line).
|
|
header {
|
|
Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
|
|
X-Content-Type-Options "nosniff"
|
|
X-Frame-Options "DENY"
|
|
Referrer-Policy "strict-origin-when-cross-origin"
|
|
Permissions-Policy "camera=(), microphone=(), geolocation=()"
|
|
-Server
|
|
}
|
|
|
|
try_files {path} /index.html
|
|
|
|
# sw.js/registerSW.js are fixed filenames (not content-hashed like the
|
|
# rest of the build), so they must always be revalidated — otherwise a
|
|
# browser that already cached sw.js never asks for a newer one and the
|
|
# PWA freezes on whatever version was installed the first time.
|
|
@swfiles {
|
|
path /sw.js /registerSW.js
|
|
}
|
|
header @swfiles Cache-Control "no-cache"
|
|
|
|
@static {
|
|
path *.js *.css *.png *.jpg *.svg *.ico *.woff2 *.woff
|
|
not path /sw.js /registerSW.js
|
|
}
|
|
header @static Cache-Control "public, max-age=31536000, immutable"
|
|
|
|
file_server
|
|
}
|