fix: use explicit expression for domain blocking and improve IP forwarding

Author: webees

config/Caddyfile

@@ -8,7 +8,6 @@
 	admin off
 	persist_config off
 
-	# Trust private network ranges for Fly.io
 	servers {
 		trusted_proxies static private_ranges
 	}
@@ -22,39 +21,41 @@
 
 # ── Site Block ────────────────────────────────────────────────────────────────
 :80 {
-	# Block only if (NOT /health) AND (domain NOT in whitelist)
-	@blocked {
-		not path /health
-		not host {$CADDY_DOMAINS:*}
+	# Explicitly handle health checks
+	handle /health {
+		respond "OK" 200
 	}
-	abort @blocked
 
-	# Reverse proxy to application
+	# Domain Whitelist Enforcement
+	# If CADDY_DOMAINS is set, block everything else
+	@outside_domain {
+		expression `{env.CADDY_DOMAINS} != ""`
+		not host {$CADDY_DOMAINS}
+	}
+	handle @outside_domain {
+		respond "Access Denied: Domain not allowed" 403
+	}
+
+	# Main application handling
 	handle {
 		encode zstd gzip
 
-		# Security headers
 		header {
-			# Infrastructure security
 			Strict-Transport-Security "max-age=31536000;"
 			X-Content-Type-Options "nosniff"
 			X-Frame-Options "DENY"
 			X-XSS-Protection "1; mode=block"
-
-			# Privacy & Permissions
 			Referrer-Policy "strict-origin-when-cross-origin"
 			Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()"
 			X-Robots-Tag "noindex, nofollow"
-
-			# Fingerprint removal
 			-Server
 			-X-Powered-By
 			-Last-Modified
 		}
 
 		reverse_proxy localhost:8080 {
-			header_up X-Real-IP {http.request.header.Fly-Client-IP:{remote_host}}
-			header_up X-Forwarded-For {http.request.header.Fly-Client-IP:{remote_host}}
+			header_up X-Real-IP {http.request.header.Fly-Client-IP}
+			header_up X-Forwarded-For {http.request.header.Fly-Client-IP}
 		}
 	}
 }