affilibuster/Caddyfile at develop · rdrkr/affilibuster · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
# Copyright (c) 2026 Affilibuster by Ronen Druker.
#
# Caddy reverse proxy configuration for production.
# Handles automatic Let's Encrypt SSL for all domains.
# All upstream services communicate via plain HTTP inside Docker.

# Main site: thegreenbrother.com
thegreenbrother.com, www.thegreenbrother.com {
	# Next.js API routes: proxy to frontend (must be before backend catch-all)
	handle /api/preview* {
		reverse_proxy the-green-brother:{$THE_GREEN_BROTHER_PORT}
	}
	handle /api/health* {
		reverse_proxy the-green-brother:{$THE_GREEN_BROTHER_PORT}
	}

	# Backend API requests: strip /api prefix and proxy to backend
	handle_path /api/* {
		reverse_proxy backend:{$BACKEND_PORT}
	}

	# All other requests go to Next.js frontend
	reverse_proxy the-green-brother:{$THE_GREEN_BROTHER_PORT}

	# Security headers
	header {
		Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
		X-Content-Type-Options "nosniff"
		Referrer-Policy "strict-origin-when-cross-origin"
		Permissions-Policy "camera=(), microphone=(), geolocation=()"
		# Remove server identification
		-Server
	}

	# Compression
	encode zstd gzip
}

# CMS admin: cms.thegreenbrother.com
cms.thegreenbrother.com {
	reverse_proxy strapi:{$CMS_PORT}

	# Security headers
	header {
		Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
		X-Content-Type-Options "nosniff"
		X-Frame-Options "SAMEORIGIN"
		Referrer-Policy "strict-origin-when-cross-origin"
		Permissions-Policy "camera=(), microphone=(), geolocation=()"
		-Server
	}

	# Compression
	encode zstd gzip
}

# Monitoring: uptime.thegreenbrother.com
uptime.thegreenbrother.com {
	reverse_proxy uptime-kuma:3001

	# Security headers
	header {
		Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
		X-Content-Type-Options "nosniff"
		X-Frame-Options "SAMEORIGIN"
		Referrer-Policy "strict-origin-when-cross-origin"
		Permissions-Policy "camera=(), microphone=(), geolocation=()"
		X-Robots-Tag "noindex, nofollow, noarchive"
		-Server
	}

	# Compression
	encode zstd gzip
}