1{
  2	storage redis {
  3		address {$VALKEY_ADDR}
  4		password "{$VALKEY_PASSWORD}"
  5		timeout 5
  6		key_prefix "caddy"
  7	}
  8	on_demand_tls {
  9		ask http://web:3000/check
 10	}
 11	servers {
 12		metrics
 13		trusted_proxies static 0.0.0.0/0
 14	}
 15}
 16
 17# custom domains
 18:443 {
 19	reverse_proxy web:3000
 20	log {
 21		format append {
 22			server_id {$APP_DOMAIN}
 23		}
 24	}
 25	tls {$APP_EMAIL} {
 26		on_demand
 27	}
 28	encode zstd gzip
 29}
 30
 31# subdomains and root pgs domain
 32*.{$APP_DOMAIN}, {$APP_DOMAIN} {
 33	reverse_proxy web:3000
 34	log {
 35		format append {
 36			server_id {$APP_DOMAIN}
 37		}
 38	}
 39	tls {$APP_EMAIL} {
 40		dns cloudflare {$CF_API_TOKEN}
 41		resolvers 1.1.1.1
 42	}
 43
 44	encode zstd gzip
 45
 46	header {
 47		# disable FLoC tracking
 48		?Permissions-Policy interest-cohort=()
 49
 50		# enable HSTS
 51		?Strict-Transport-Security max-age=31536000;
 52
 53		# disable clients from sniffing the media type
 54		?X-Content-Type-Options nosniff
 55
 56		# clickjacking protection
 57		?X-Frame-Options DENY
 58
 59		# keep referrer data off of HTTP connections
 60		?Referrer-Policy no-referrer-when-downgrade
 61
 62		?X-XSS-Protection "1; mode=block"
 63	}
 64
 65	@caddymetrics {
 66		host {$APP_DOMAIN} *.{$APP_DOMAIN}
 67		path /_caddy/metrics
 68	}
 69
 70	metrics @caddymetrics {
 71		disable_openmetrics
 72	}
 73
 74	@sshmetrics {
 75		host {$APP_DOMAIN} *.{$APP_DOMAIN}
 76		path /_ssh/metrics
 77	}
 78
 79	handle @sshmetrics {
 80		rewrite * /metrics
 81		reverse_proxy ssh:9222
 82	}
 83
 84	@webmetrics {
 85		host {$APP_DOMAIN} *.{$APP_DOMAIN}
 86		path /_web/metrics
 87	}
 88
 89	handle @webmetrics {
 90		rewrite * /_metrics
 91		reverse_proxy web:3000 {
 92			header_up Host {$APP_DOMAIN}
 93		}
 94	}
 95
 96	@imgproxymetrics {
 97		host {$APP_DOMAIN} *.{$APP_DOMAIN}
 98		path /_imgproxy/metrics
 99	}
100
101	handle @imgproxymetrics {
102		rewrite * /metrics
103		reverse_proxy imgproxy:8081
104	}
105}