From 0df91771d563186339e12a5e9da839bd25dfe2bc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lumi=C3=A8re=20=C3=89lev=C3=A9?=
 <88174309+PoneyClairDeLune@users.noreply.github.com>
Date: Sat, 24 Aug 2024 09:12:21 +0100
Subject: [PATCH] Caddyfile: More reverse proxying

---
 docs/example-advanced.caddy.conf | 48 ++++++++++++++++++++++++++++----
 1 file changed, 43 insertions(+), 5 deletions(-)

diff --git a/docs/example-advanced.caddy.conf b/docs/example-advanced.caddy.conf
index bfdc22767..cdc860f7a 100644
--- a/docs/example-advanced.caddy.conf
+++ b/docs/example-advanced.caddy.conf
@@ -8,6 +8,12 @@
 #   installation (http server by the Nodejs process). If you are using CryptPad
 #   in production and require professional support please contact sales@cryptpad.fr
 
+@trustedProxies {
+	# Force Caddy to accept `X-Forwarded-For` and other origin headers.
+	# Modify the line below if you want to restrict the scope of direct downstream sending these headers.
+	trusted_proxies 0.0.0.0/0 ::/0
+}
+
 # Caddy does not have variables for server names, so domains need to be hardcoded.
 # You can bulk replace "your-main-domain.com" and "your-sandbox-domain.com" safely.
 your-main-domain.com:443,
@@ -126,7 +132,7 @@ your-sandbox-domain.com:443 {
 		path "*.mjs"
 	}
 	header @fileModuleJS Content-Type "application/javascript"
-
+	
 	# The Node.js process can handle all traffic, whether accessed over websocket or as static assets.
 	# We prefer to serve static content from Caddy directly, and to leave the API server to handle the
 	# the dynamic content that only it can manage. This is primarily for optimization.
@@ -135,12 +141,44 @@ your-sandbox-domain.com:443 {
 			to 127.0.0.1:3003
 			header_up Host "{host}"
 			header_up X-Real-IP "{remote_host}"
-
+			
 			# Caddy supports WebSockets directly. No additional headers are needed.
 
-			# Force Caddy to accept `X-Forwarded-For` and other origin headers.
-			# Modify the line below if you want to restrict the scope of direct downstream sending these headers.
-			trusted_proxies 0.0.0.0/0 ::/0
+			import trustedProxies
+		}
+	}
+	
+	handle_path /customize.dist/* {
+		# This is needed in order to prevent infinite recursion between /customize/ and the root.
+	}
+	
+	# Try to load customizeable content via /customize/ and fall back to the default content located
+	# at /customize.dist/ .
+	# This is what allows you to override behaviour.
+	handle_path /customize/* {
+		try_files /customize/{path} /customize.dist/{path}
+		file_server {
+			index index.html index.htm default.html default.htm
+		}
+	}
+	
+	# /api/config is loaded once per page load, and is used to retrieve the caching variable,
+	# which is applied to every other resource loaded during that session.
+	@sharedReverseProxy {
+		path /api/*
+		path /extensions.js
+	}
+	handle @sharedReverseProxy {
+		reverse_proxy * {
+			to 127.0.0.1:3000
+			header_up Host "{host}"
+			header_up X-Real-IP "{remote_host}"
+			
+			# These settings prevent both Caddy and the API server from setting duplicate headers.
+			header_down Cross-Origin-Resource-Policy cross-origin
+			header_down Cross-Origin-Embedder-Policy require-corp
+
+			import trustedProxies
 		}
 	}