photoplaces/deploy/Caddyfile

{
	admin off
	http_port 80
}

# API subdomain — прокси на backend + MinIO
api.{$DOMAIN} {
	@minioConsole {
		path /minio-console/*
	}
	handle_path @minioConsole {
		reverse_proxy minio:9001 {
			header_up Host {host}
			header_up X-Real-IP {remote}
			header_up X-Forwarded-For {remote}
			header_up X-Forwarded-Proto {scheme}
		}
	}

	@s3 {
		path /s3/*
	}
	reverse_proxy @s3 minio:9000 {
		header_up Host {host}
		header_up X-Real-IP {remote}
		header_up X-Forwarded-For {remote}
		header_up X-Forwarded-Proto {scheme}
	}

	reverse_proxy backend:8080 {
		header_up Host {host}
		header_up X-Real-IP {remote}
		header_up X-Forwarded-For {remote}
		header_up X-Forwarded-Proto {scheme}
	}

	header {
		X-Content-Type-Options "nosniff"
		X-Frame-Options "DENY"
		Referrer-Policy "strict-origin-when-cross-origin"
		Permissions-Policy "geolocation=(self), microphone=(), camera=()"
	}

	@auth {
		path /api/v1/auth/*
	}
	rate_limit @auth {
		zone auth
		rate 10/minute
		key {remote}
	}
}

# Frontend main domain
{$DOMAIN} {
	reverse_proxy frontend:3000 {
		header_up Host {host}
		header_up X-Real-IP {remote}
		header_up X-Forwarded-For {remote}
		header_up X-Forwarded-Proto {scheme}
	}

	header {
		X-Content-Type-Options "nosniff"
		X-Frame-Options "DENY"
		Referrer-Policy "strict-origin-when-cross-origin"
		Permissions-Policy "geolocation=(self), microphone=(), camera=()"
		Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://api-maps.yandex.ru; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self' wss: https://api.{$DOMAIN} https://api-maps.yandex.ru; frame-ancestors 'none';"
	}

	@static {
		path /_next/static/*
		path /static/*
		path /images/*
		path /favicon.ico
	}
	header @static Cache-Control "public, max-age=31536000, immutable"

	encode zstd gzip
}