Translated the majority of NGINX config into Caddy.

2026-09-14 11:05:41 +05:00 · 2024-08-24 08:34:20 +01:00 · 2024-08-24 08:34:20 +01:00 · 73098d3640
commit 73098d3640
parent a46efaafa8
1 changed files with 134 additions and 0 deletions
--- a/docs/example-advanced.caddy.conf
+++ b/docs/example-advanced.caddy.conf
@ -0,0 +1,134 @@
+# SPDX-FileCopyrightText: 2023 XWiki CryptPad Team <contact@cryptpad.org> and contributors
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+#   This file is included strictly as an example of how Nginx can be configured
+#   to work with CryptPad. This example WILL NOT WORK AS IS. For best results,
+#   compare the sections of this configuration file against a working CryptPad
+#   installation (http server by the Nodejs process). If you are using CryptPad
+#   in production and require professional support please contact sales@cryptpad.fr
+
+# Caddy does not have variables for server names, so domains need to be hardcoded.
+# You can bulk replace "your-main-domain.com" and "your-sandbox-domain.com" safely.
+your-main-domain.com:443,
+your-sandbox-domain.com:443 {
+	# Define your certificates below.
+	# No need to adjust TLS configurations, as the defaults in Caddy are already secure.
+	tls /path/to/fullchain/publicKey.pem /path/to/certificate/privateKey.pem
+	
+	# Enable HSTS.
+	# Do not enable this line when configuring over mixnet, e.g. Tor.
+	header Strict-Transport-Security "max-age=63072000; includeSubDomains"
+	
+	# Security headers
+	header X-XSS-Protection "1; mode=block"
+	header X-Content-Type-Options "nosniff"
+	header Access-Control-Allow-Credentials "true"
+	#header X-Frame-Options "SAMEORIGIN"
+	
+	# By default CryptPad forbids remote domains from embedding CryptPad documents in iframes.
+	# The sandbox domain must always be permitted in order for the platform to function.
+	# If you wish to enable remote embedding you may change the value below to "*"
+	# as per the commented value.
+	header Access-Control-Allow-Origin "https://your-sandbox-domain.com"
+	#header Access-Control-Allow-Origin "*"
+	
+	# Opt out of Google's FLoC Network
+	header Permissions-Policy "interest-cohort=()"
+	
+	# Enable SharedArrayBuffer in Firefox (for .xlsx export)
+	header Cross-Origin-Resource-Policy "cross-origin"
+	header Cross-Origin-Embedder-Policy "require-corp"
+	
+	# Specify the relative path to root of your custom error page.
+	# This error page won't only be served for 404 errors.
+	handle_errors {
+		rewrite * /error.htm
+		header Cache-Control "no-cache, no-store"
+		file_server
+		templates
+	}
+	
+	# Insert the path to your CryptPad repository root here
+	root /home/cryptpad/cryptpad
+	
+	# Any static assets loaded with "vers=" in their URL will be cached for a year
+	@staticAssets {
+		query "ver=*"
+	}
+	header @staticAssets Cache-Control "max-age=31536000"
+	
+	vars {
+		# CSS can be dynamically set inline, loaded from the same domain, or from your main domain.
+		styleSrc   "'unsafe-inline' 'self' https://your-main-domain.com"
+		
+		# connect-src restricts URLs which can be loaded using script interfaces.
+		# If you have configured your instance to use a dedicated file delivery domain or API domain,
+		# you will need to add them below.
+		connectSrc "'self' https://your-main-domain.com blob: wss://api.your-main-domain.com https://your-sandbox-domain.com"
+		
+		# Fonts can be loaded from data-URLs or the main domain.
+		fontSrc    "'self' data: https://your-main-domain.com"
+		
+		# Images can be loaded from anywhere, though we'd like to deprecate this as it allows
+		# the use of images for tracking.
+		imgSrc     "'self' data: blob: https://your-main-domain.com"
+		
+		# frame-src specifies valid sources for nested browsing contexts.
+		# This prevents loading any iframes from anywhere other than the sandbox domain.
+		frameSrc   "'self' https://your-sandbox-domain.com blob:"
+		
+		# media-src specifies valid sources for loading media using video or audio.
+		mediaSrc   "blob:"
+		
+		# child-src defines valid sources for webworkers and nested browser contexts.
+		# It is deprecated in favour of worker-src and frame-src.
+		childSrc   "https://your-main-domain.com"
+		
+		# worker-src valid sources for Worker, Shared Worker, or Service Worker scripts.
+		# Supercedes child-src, but is unfortunately not yet universally supported.
+		workerSrc  "'self'"
+		
+		# script-src specifies valid sources for JavaScript, including inline handlers.
+		scriptSrc  "'self' resource: https://your-main-domain.com"
+		
+		# frame-ancestors specifies which origins can embed your CryptPad instance.
+		# This must include 'self' and your main domain (over HTTPS) in order for CryptPad to work,
+		# if you have enabled remote embedding via the admin panel, then this must be more permissive.
+		# Note: cryptpad.fr permits web pages served via https: and vector: (element desktop app)
+		frameAncestors "'self' https://your-main-domain.com"
+		#frameAncestors "'self' https: vector:"
+		
+		# A few assets are loaded via the sandbox domain.
+		# They unfortunately still require exceptions to the sandboxing to work correctly.
+		# Everything except the sandbox domain is a privileged scope, as they might be used to handle keys.
+		# Unsafe iframes are exceptions. Office file formats are converted outside of the sandboxed scope,
+		# because of bugs in Chromium-based browsers that incorrectly ignore headers supposed to enable
+		# the use of some modern APIs, that are required when JavaScript is run in a cross-origin context.
+		# We've applied other sandboxing techniques to mitigate the risk of running WebAssembly
+		# in this privileged scope.
+		# Privileged contexts allow a few more rights than unprivileged contexts, though limits are still applied.
+		scriptSrcUnsafe "'self' 'unsafe-eval' 'unsafe-inline' resource: https://your-main-domain.com"
+	}
+	
+	# Finally, set all the security rules you have composed above.
+	@privilegedScope {
+		host "your-sandbox-domain.com"
+		path_regexp "^\\/(sheet|doc|presentation)\\/inner.html.*$)"
+		path_regexp "^\\/common\\/onlyoffice\\/.*\\/.*\\.html.*$)"
+		path_regexp "^\\/unsafeiframe\\/inner\\.html.*$)"
+	}
+	header @privilegedScope Content-Security-Policy "default-src 'none'; child-src {vars.childSrc}; worker-src {vars.workerSrc}; media-src {vars.mediaSrc}; style-src {vars.styleSrc}; script-src {vars.scriptSrcUnsafe}; connect-src {vars.connectSrc}; font-src {vars.fontSrc}; img-src {vars.imgSrc}; frame-src {vars.frameSrc}; frame-ancestors {vars.frameAncestors}"
+	header ?Content-Security-Policy "default-src 'none'; child-src {vars.childSrc}; worker-src {vars.workerSrc}; media-src {vars.mediaSrc}; style-src {vars.styleSrc}; script-src {vars.scriptSrc}; connect-src {vars.connectSrc}; font-src {vars.fontSrc}; img-src {vars.imgSrc}; frame-src {vars.frameSrc}; frame-ancestors {vars.frameAncestors}"
+	
+	# Add support for .mjs files used by pdfjs
+	@fileModuleJS {
+		path "*.mjs"
+	}
+	header @fileModuleJS Content-Type "application/javascript"
+	
+	# Enable file serving
+	file_server {
+		index index.html index.htm default.html default.htm
+	}
+}