jacobh2
7fb86f5524
- Caddyfile: access and error logs replace the /i/<code> segment and every query string with REDACTED (regexp filter on request>uri); Authorization stays redacted by default. Deferred response headers: Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy. - Pi compose: caddy as uid 10002 with group 1000, read-only root, cap_drop ALL plus NET_BIND_SERVICE (needed to exec the image's file-capability binary), tmpfs /config and /tmp; install.sh sets /certs 0750 1000:1000 and Caddy's /data to 10002. - deploy.sh and install.sh print the pulled image digests and append them to /opt/kvitt/deployed-digests, warning when a recorded tag changed digest; the workflow prints the pushed digests; kvitt_cicd needs only write:package. - Dev stack: up.sh stages only fcm-service-account.json into infra/dev/secrets/ (git-ignored), mounted read-only at /secrets. - README: restricted cert-sync key required (plain root key not acceptable), remote_ip and log checks, APK download note, owner decisions (backup encryption, APK limit, key form, token scope), overhaul lines. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B
39 lines
1.2 KiB
Caddyfile
39 lines
1.2 KiB
Caddyfile
# Kvitt Caddyfile (SPEC §10.5.2, D-117). Installed as /opt/kvitt/Caddyfile; cert-sync reloads it through the admin API.
|
|
{
|
|
admin 0.0.0.0:2019
|
|
auto_https off
|
|
# Caddy's own error log (for example a 502 when the server is down) carries the request too: same URI filter.
|
|
log default {
|
|
output stderr
|
|
format filter {
|
|
request>uri regexp `^(/i/)[^?]+|([?]).+` `${1}${2}REDACTED`
|
|
wrap json
|
|
}
|
|
}
|
|
}
|
|
|
|
icehack.asuscomm.com:8443 {
|
|
tls /certs/fullchain.pem /certs/privkey.pem
|
|
request_body {
|
|
max_size 6MB
|
|
}
|
|
# Set after the server's response headers (defer), so a header the server also sends appears once.
|
|
header {
|
|
defer
|
|
Content-Security-Policy "default-src 'none'; style-src 'unsafe-inline'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'"
|
|
X-Content-Type-Options nosniff
|
|
X-Frame-Options DENY
|
|
Referrer-Policy no-referrer
|
|
}
|
|
reverse_proxy server:8080
|
|
# Access log: the invite code in /i/<code> and every query string (the inviter's name in ?from=) become
|
|
# REDACTED (SPEC §8.7); the Authorization header is redacted by Caddy's default.
|
|
log {
|
|
output stdout
|
|
format filter {
|
|
request>uri regexp `^(/i/)[^?]+|([?]).+` `${1}${2}REDACTED`
|
|
wrap json
|
|
}
|
|
}
|
|
}
|