jzzliu
c4c07cbc16
Strict Content-Security-Policy (the site has no inline script or style), nosniff, referrer and permissions policies, no Server header, no-cache for HTML and five-minute caching for unfingerprinted assets.
22 lines
713 B
Caddyfile
22 lines
713 B
Caddyfile
:8080 {
|
|
root * /srv/fieldwork
|
|
encode zstd gzip
|
|
|
|
header {
|
|
# The site has no inline scripts or styles, so a strict policy costs nothing.
|
|
Content-Security-Policy "default-src 'self'; img-src 'self' data:; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'"
|
|
X-Content-Type-Options nosniff
|
|
Referrer-Policy strict-origin-when-cross-origin
|
|
Permissions-Policy "camera=(), microphone=(), geolocation=()"
|
|
-Server
|
|
}
|
|
|
|
# Files are not fingerprinted, so keep asset caching short; HTML must always revalidate.
|
|
@assets path *.css *.js *.svg
|
|
header @assets Cache-Control "public, max-age=300"
|
|
@pages not path *.css *.js *.svg
|
|
header @pages Cache-Control "no-cache"
|
|
|
|
file_server
|
|
}
|