From 2cde2a684bf01d86cec25f42832e383b6b2c6bb3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lumi=C3=A8re=20=C3=89lev=C3=A9?=
 <88174309+PoneyClairDeLune@users.noreply.github.com>
Date: Sat, 24 Aug 2024 09:39:45 +0100
Subject: [PATCH] Caddyfile: blob, blocks, trailing slashes

---
 docs/example-advanced.caddy.conf | 56 +++++++++++++++++++++++++++++---
 1 file changed, 51 insertions(+), 5 deletions(-)

diff --git a/docs/example-advanced.caddy.conf b/docs/example-advanced.caddy.conf
index cdc860f7a..3f1593211 100644
--- a/docs/example-advanced.caddy.conf
+++ b/docs/example-advanced.caddy.conf
@@ -31,13 +31,19 @@ your-sandbox-domain.com:443 {
 	header X-Content-Type-Options "nosniff"
 	header Access-Control-Allow-Credentials "true"
 	#header X-Frame-Options "SAMEORIGIN"
+
+	# OnlyOffice fonts may be loaded from both domains.
+	@onlyOfficeFonts {
+		path_regexp "^\\/common\\/onlyoffice\\/.*\\/fonts\\/.*$"
+	}
+	header Access-Control-Allow-Origin "*"
 	
 	# By default CryptPad forbids remote domains from embedding CryptPad documents in iframes.
 	# The sandbox domain must always be permitted in order for the platform to function.
 	# If you wish to enable remote embedding you may change the value below to "*"
 	# as per the commented value.
-	header Access-Control-Allow-Origin "https://your-sandbox-domain.com"
-	#header Access-Control-Allow-Origin "*"
+	header ?Access-Control-Allow-Origin "https://your-sandbox-domain.com"
+	#header ?Access-Control-Allow-Origin "*"
 	
 	# Opt out of Google's FLoC Network
 	header Permissions-Policy "interest-cohort=()"
@@ -120,9 +126,9 @@ your-sandbox-domain.com:443 {
 	# Finally, set all the security rules you have composed above.
 	@privilegedScope {
 		host "your-sandbox-domain.com"
-		path_regexp "^\\/(sheet|doc|presentation)\\/inner.html.*$)"
-		path_regexp "^\\/common\\/onlyoffice\\/.*\\/.*\\.html.*$)"
-		path_regexp "^\\/unsafeiframe\\/inner\\.html.*$)"
+		path_regexp "^\\/(sheet|doc|presentation)\\/inner.html.*$"
+		path_regexp "^\\/common\\/onlyoffice\\/.*\\/.*\\.html.*$"
+		path_regexp "^\\/unsafeiframe\\/inner\\.html.*$"
 	}
 	header @privilegedScope Content-Security-Policy "default-src 'none'; child-src {vars.childSrc}; worker-src {vars.workerSrc}; media-src {vars.mediaSrc}; style-src {vars.styleSrc}; script-src {vars.scriptSrcUnsafe}; connect-src {vars.connectSrc}; font-src {vars.fontSrc}; img-src {vars.imgSrc}; frame-src {vars.frameSrc}; frame-ancestors {vars.frameAncestors}"
 	header ?Content-Security-Policy "default-src 'none'; child-src {vars.childSrc}; worker-src {vars.workerSrc}; media-src {vars.mediaSrc}; style-src {vars.styleSrc}; script-src {vars.scriptSrc}; connect-src {vars.connectSrc}; font-src {vars.fontSrc}; img-src {vars.imgSrc}; frame-src {vars.frameSrc}; frame-ancestors {vars.frameAncestors}"
@@ -182,6 +188,46 @@ your-sandbox-domain.com:443 {
 		}
 	}
 	
+	# Requests for blobs and blocks are now proxied to the API server.
+	# This simplifies Caddy path configuration, in the event they are being hosted in a non-standard location
+	# or with odd unexpected permissions. Serving blobs in this manner also means that it will be possible to
+	# enforce access control for them, though this is not yet implemented.
+	# Access control (via TOTP 2FA) has been added to blocks, so they can be handled with the same directives.
+	@blobsAndBlocks {
+		path /blob/*
+		path /block/*
+	}
+	handle @blobsAndBlocks {
+		@corsPreflight {
+			method OPTIONS
+			header Access-Control-Allow-Origin "https://your-sandbox-domain.com"
+			header Access-Control-Allow-Credentials "true"
+			header Access-Control-Allow-Methods "GET, POST, OPTIONS"
+			header Access-Control-Allow-Headers "DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range"
+			header Access-Control-Max-Age "1728000"
+			header Content-Type "application/octet-stream; charset=utf-8"
+			header Content-Length "0"
+			respond 204
+		}
+		reverse_proxy * {
+			to 127.0.0.1:3000
+			# Preventing these headers from getting duplicated, since we are proxying to the API server.
+			header_down -X-Content-Type-Options
+			header_down -Access-Control-Allow-Origin
+			header_down -Permissions-Policy
+			header_down -X-XSS-Protection
+			header_down -Cross-Origin-Resource-Policy
+			header_down -Cross-Origin-Embedder-Policy
+		}
+	}
+	
+	# The Node.JS server has some built-in forwarding rulesets to prevent URLs not suffixed with a slash
+	# from resulting in a 404 error. This simply adds a trailing slash to a variety of applications.
+	@preventNotFound {
+		path_regexp "^/(register|login|recovery|settings|user|pad|drive|poll|slide|code|whiteboard|file|media|profile|contacts|todo|filepicker|debug|kanban|sheet|support|admin|notifications|teams|calendar|presentation|doc|form|report|convert|checkup|diagram)$"
+	}
+	redir @preventNotFound "{path}/"
+	
 	# Enable file serving
 	file_server {
 		index index.html index.htm default.html default.htm