photoplaces/deploy/Caddyfile

{
	http_port 80
}

# API subdomain — прокси на backend + MinIO (HTTP, SSL на Synology)
http://api.{$DOMAIN} {
	@s3 {
		path /s3/*
	}
	reverse_proxy @s3 minio:9000 {
		header_up Host {host}
		header_up X-Real-IP {remote}
	}

	reverse_proxy backend:8080 {
		header_up Host {host}
		header_up X-Real-IP {remote}
	}

	header {
		X-Content-Type-Options "nosniff"
		X-Frame-Options "DENY"
		Referrer-Policy "strict-origin-when-cross-origin"
		Permissions-Policy "geolocation=(self), microphone=(), camera=()"
	}
}

# Frontend main domain
http://{$DOMAIN} {
	reverse_proxy frontend:3000 {
		header_up Host {host}
		header_up X-Real-IP {remote}
	}

	header {
		X-Content-Type-Options "nosniff"
		X-Frame-Options "DENY"
		Referrer-Policy "strict-origin-when-cross-origin"
		Permissions-Policy "geolocation=(self), microphone=(), camera=()"
		Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://api-maps.yandex.ru; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self' wss: https://api.{$DOMAIN} https://api-maps.yandex.ru; worker-src https://api-maps.yandex.ru blob:; frame-ancestors 'none';"
	}

	@static {
		path /_next/static/*
		path /static/*
		path /images/*
		path /favicon.ico
	}
	header @static Cache-Control "public, max-age=31536000, immutable"

	encode zstd gzip
}