OpencodeHub/Caddyfile at main · swadhinbiswas/OpencodeHub · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
# OpenCodeHub Production Reverse Proxy
# Caddy auto-provisions TLS certificates via Let's Encrypt
# Usage: Place this in /etc/caddy/Caddyfile or mount into the container

# Replace with your actual domain
opencodehub.example.com {
    # Auto HTTPS with Let's Encrypt
    tls admin@example.com

    # Security headers
    header {
        Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
        X-Content-Type-Options "nosniff"
        X-Frame-Options "DENY"
        X-XSS-Protection "1; mode=block"
        Referrer-Policy "strict-origin-when-cross-origin"
        Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()"
        -Server
        -X-Powered-By
    }

    # Request body size limit (10MB default, git push needs more)
    request_body {
        max_size 50MB
    }

    # Proxy to OpenCodeHub app
    reverse_proxy app:4321 {
        # Health check the upstream
        health_uri /api/health
        health_interval 30s
        health_timeout 10s

        # Pass real client info
        header_up X-Real-IP {remote_host}
        header_up X-Forwarded-For {remote_host}
        header_up X-Forwarded-Proto {scheme}

        # Timeouts
        transport http {
            dial_timeout 10s
            response_header_timeout 300s
            read_timeout 300s
            write_timeout 300s
        }
    }

    # Git smart HTTP endpoint — larger timeouts for push/pull
    handle_path /git/* {
        reverse_proxy app:4321 {
            header_up X-Real-IP {remote_host}
            header_up X-Forwarded-For {remote_host}
            header_up X-Forwarded-Proto {scheme}

            transport http {
                dial_timeout 10s
                response_header_timeout 600s
                read_timeout 600s
                write_timeout 600s
            }
        }
    }

    # Git LFS endpoints
    handle_path /info/* {
        reverse_proxy app:4321 {
            header_up X-Real-IP {remote_host}
            header_up X-Forwarded-For {remote_host}
            header_up X-Forwarded-Proto {scheme}

            transport http {
                dial_timeout 10s
                response_header_timeout 600s
                read_timeout 600s
                write_timeout 600s
            }
        }
    }

    # Prometheus metrics — restrict to internal network
    handle /api/metrics {
        # Only allow from localhost/monitoring
        remote_ip 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 {
            not remote_ip 0.0.0.0/0
        }
        reverse_proxy app:4321
    }

    # Health check endpoint — public
    handle /api/health {
        reverse_proxy app:4321
    }

    # Logging
    log {
        output file /var/log/caddy/access.log {
            roll_size 100mb
            roll_keep 10
        }
        format json
    }
}

# Metrics-only listener (internal network)
:9090 {
    metrics
}