Caddyfile.example

# Copy to Caddyfile (gitignored) and replace domains/IPs for your deployment.
#
# Security headers below address common baseline scan failures:
#   Strict-Transport-Security  — HTTPS-only (HSTS)
#   X-Frame-Options            — clickjacking protection
#   COOP / CORP / COEP         — cross-origin isolation (defense-in-depth)
#
# Content-Security-Policy is set by the Next.js proxy (frontend/src/proxy.ts)
# with per-request nonces — do NOT re-declare CSP here or scanners / browsers
# will see a second policy that still allows unsafe-inline and breaks nonces.

operationchildshield.org, www.operationchildshield.org {
	encode gzip

	header {
		# Force HTTPS for 1 year on this host and subdomains
		Strict-Transport-Security "max-age=31536000; includeSubDomains"

		# Clickjacking: deny framing (also covered by Next CSP frame-ancestors)
		X-Frame-Options "DENY"

		# MIME sniffing protection
		X-Content-Type-Options "nosniff"

		# Limit referrer leakage on cross-origin navigations
		Referrer-Policy "strict-origin-when-cross-origin"

		# Disable unused powerful browser features
		Permissions-Policy "camera=(), microphone=(), geolocation=()"

		# Cross-origin isolation (defense-in-depth)
		# COEP credentialless allows third-party images (e.g. congress.gov) without CORP
		Cross-Origin-Opener-Policy "same-origin"
		Cross-Origin-Resource-Policy "same-origin"
		Cross-Origin-Embedder-Policy "credentialless"

		# Reduce server fingerprinting (Next.js / uvicorn / Caddy defaults)
		-Server
		-X-Powered-By
	}

	# Optional: serve hero flag from host bind-mount if not yet in the frontend image.
	# Requires compose volume: ./static-override:/srv/static:ro
	# and file: static-override/images/american_flag.jpg
	handle /images/american_flag.jpg {
		root * /srv/static
		file_server
	}

	# Overwrite client-supplied forwarding headers so backends see the real peer.
	# Delete then set X-Forwarded-For so client-spoofed leftmost hops cannot stick.
	reverse_proxy /api/* backend:8000 {
		header_up X-Real-IP {remote_host}
		header_up -X-Forwarded-For
		header_up X-Forwarded-For {remote_host}
	}
	reverse_proxy frontend:3000 {
		header_up X-Real-IP {remote_host}
		header_up -X-Forwarded-For
		header_up X-Forwarded-For {remote_host}
	}
}

# Optional: redirect bare IP to canonical HTTPS domain
# http://YOUR_SERVER_IP {
#     redir https://operationchildshield.org{uri} permanent
# }