From 73098d36409428ec27f43dbc3903a105c80e4e9c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lumi=C3=A8re=20=C3=89lev=C3=A9?= <88174309+PoneyClairDeLune@users.noreply.github.com> Date: Sat, 24 Aug 2024 08:34:20 +0100 Subject: [PATCH 01/14] Translated the majority of NGINX config into Caddy. --- docs/example-advanced.caddy.conf | 134 +++++++++++++++++++++++++++++++ 1 file changed, 134 insertions(+) create mode 100644 docs/example-advanced.caddy.conf diff --git a/docs/example-advanced.caddy.conf b/docs/example-advanced.caddy.conf new file mode 100644 index 000000000..8a6ba3a7f --- /dev/null +++ b/docs/example-advanced.caddy.conf @@ -0,0 +1,134 @@ +# SPDX-FileCopyrightText: 2023 XWiki CryptPad Team and contributors +# +# SPDX-License-Identifier: AGPL-3.0-or-later + +# This file is included strictly as an example of how Nginx can be configured +# to work with CryptPad. This example WILL NOT WORK AS IS. For best results, +# compare the sections of this configuration file against a working CryptPad +# installation (http server by the Nodejs process). If you are using CryptPad +# in production and require professional support please contact sales@cryptpad.fr + +# Caddy does not have variables for server names, so domains need to be hardcoded. +# You can bulk replace "your-main-domain.com" and "your-sandbox-domain.com" safely. +your-main-domain.com:443, +your-sandbox-domain.com:443 { + # Define your certificates below. + # No need to adjust TLS configurations, as the defaults in Caddy are already secure. + tls /path/to/fullchain/publicKey.pem /path/to/certificate/privateKey.pem + + # Enable HSTS. + # Do not enable this line when configuring over mixnet, e.g. Tor. + header Strict-Transport-Security "max-age=63072000; includeSubDomains" + + # Security headers + header X-XSS-Protection "1; mode=block" + header X-Content-Type-Options "nosniff" + header Access-Control-Allow-Credentials "true" + #header X-Frame-Options "SAMEORIGIN" + + # By default CryptPad forbids remote domains from embedding CryptPad documents in iframes. + # The sandbox domain must always be permitted in order for the platform to function. + # If you wish to enable remote embedding you may change the value below to "*" + # as per the commented value. + header Access-Control-Allow-Origin "https://your-sandbox-domain.com" + #header Access-Control-Allow-Origin "*" + + # Opt out of Google's FLoC Network + header Permissions-Policy "interest-cohort=()" + + # Enable SharedArrayBuffer in Firefox (for .xlsx export) + header Cross-Origin-Resource-Policy "cross-origin" + header Cross-Origin-Embedder-Policy "require-corp" + + # Specify the relative path to root of your custom error page. + # This error page won't only be served for 404 errors. + handle_errors { + rewrite * /error.htm + header Cache-Control "no-cache, no-store" + file_server + templates + } + + # Insert the path to your CryptPad repository root here + root /home/cryptpad/cryptpad + + # Any static assets loaded with "vers=" in their URL will be cached for a year + @staticAssets { + query "ver=*" + } + header @staticAssets Cache-Control "max-age=31536000" + + vars { + # CSS can be dynamically set inline, loaded from the same domain, or from your main domain. + styleSrc "'unsafe-inline' 'self' https://your-main-domain.com" + + # connect-src restricts URLs which can be loaded using script interfaces. + # If you have configured your instance to use a dedicated file delivery domain or API domain, + # you will need to add them below. + connectSrc "'self' https://your-main-domain.com blob: wss://api.your-main-domain.com https://your-sandbox-domain.com" + + # Fonts can be loaded from data-URLs or the main domain. + fontSrc "'self' data: https://your-main-domain.com" + + # Images can be loaded from anywhere, though we'd like to deprecate this as it allows + # the use of images for tracking. + imgSrc "'self' data: blob: https://your-main-domain.com" + + # frame-src specifies valid sources for nested browsing contexts. + # This prevents loading any iframes from anywhere other than the sandbox domain. + frameSrc "'self' https://your-sandbox-domain.com blob:" + + # media-src specifies valid sources for loading media using video or audio. + mediaSrc "blob:" + + # child-src defines valid sources for webworkers and nested browser contexts. + # It is deprecated in favour of worker-src and frame-src. + childSrc "https://your-main-domain.com" + + # worker-src valid sources for Worker, Shared Worker, or Service Worker scripts. + # Supercedes child-src, but is unfortunately not yet universally supported. + workerSrc "'self'" + + # script-src specifies valid sources for JavaScript, including inline handlers. + scriptSrc "'self' resource: https://your-main-domain.com" + + # frame-ancestors specifies which origins can embed your CryptPad instance. + # This must include 'self' and your main domain (over HTTPS) in order for CryptPad to work, + # if you have enabled remote embedding via the admin panel, then this must be more permissive. + # Note: cryptpad.fr permits web pages served via https: and vector: (element desktop app) + frameAncestors "'self' https://your-main-domain.com" + #frameAncestors "'self' https: vector:" + + # A few assets are loaded via the sandbox domain. + # They unfortunately still require exceptions to the sandboxing to work correctly. + # Everything except the sandbox domain is a privileged scope, as they might be used to handle keys. + # Unsafe iframes are exceptions. Office file formats are converted outside of the sandboxed scope, + # because of bugs in Chromium-based browsers that incorrectly ignore headers supposed to enable + # the use of some modern APIs, that are required when JavaScript is run in a cross-origin context. + # We've applied other sandboxing techniques to mitigate the risk of running WebAssembly + # in this privileged scope. + # Privileged contexts allow a few more rights than unprivileged contexts, though limits are still applied. + scriptSrcUnsafe "'self' 'unsafe-eval' 'unsafe-inline' resource: https://your-main-domain.com" + } + + # Finally, set all the security rules you have composed above. + @privilegedScope { + host "your-sandbox-domain.com" + path_regexp "^\\/(sheet|doc|presentation)\\/inner.html.*$)" + path_regexp "^\\/common\\/onlyoffice\\/.*\\/.*\\.html.*$)" + path_regexp "^\\/unsafeiframe\\/inner\\.html.*$)" + } + header @privilegedScope Content-Security-Policy "default-src 'none'; child-src {vars.childSrc}; worker-src {vars.workerSrc}; media-src {vars.mediaSrc}; style-src {vars.styleSrc}; script-src {vars.scriptSrcUnsafe}; connect-src {vars.connectSrc}; font-src {vars.fontSrc}; img-src {vars.imgSrc}; frame-src {vars.frameSrc}; frame-ancestors {vars.frameAncestors}" + header ?Content-Security-Policy "default-src 'none'; child-src {vars.childSrc}; worker-src {vars.workerSrc}; media-src {vars.mediaSrc}; style-src {vars.styleSrc}; script-src {vars.scriptSrc}; connect-src {vars.connectSrc}; font-src {vars.fontSrc}; img-src {vars.imgSrc}; frame-src {vars.frameSrc}; frame-ancestors {vars.frameAncestors}" + + # Add support for .mjs files used by pdfjs + @fileModuleJS { + path "*.mjs" + } + header @fileModuleJS Content-Type "application/javascript" + + # Enable file serving + file_server { + index index.html index.htm default.html default.htm + } +} From 538c4ba9245ed980f0f6710b0e61314fc038893b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lumi=C3=A8re=20=C3=89lev=C3=A9?= <88174309+PoneyClairDeLune@users.noreply.github.com> Date: Sat, 24 Aug 2024 08:49:44 +0100 Subject: [PATCH 02/14] Caddyfile: CryptPad WebSocket --- docs/example-advanced.caddy.conf | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) diff --git a/docs/example-advanced.caddy.conf b/docs/example-advanced.caddy.conf index 8a6ba3a7f..bfdc22767 100644 --- a/docs/example-advanced.caddy.conf +++ b/docs/example-advanced.caddy.conf @@ -2,7 +2,7 @@ # # SPDX-License-Identifier: AGPL-3.0-or-later -# This file is included strictly as an example of how Nginx can be configured +# This file is included strictly as an example of how Caddy can be configured # to work with CryptPad. This example WILL NOT WORK AS IS. For best results, # compare the sections of this configuration file against a working CryptPad # installation (http server by the Nodejs process). If you are using CryptPad @@ -68,11 +68,11 @@ your-sandbox-domain.com:443 { connectSrc "'self' https://your-main-domain.com blob: wss://api.your-main-domain.com https://your-sandbox-domain.com" # Fonts can be loaded from data-URLs or the main domain. - fontSrc "'self' data: https://your-main-domain.com" + fontSrc "'self' data: https://your-main-domain.com" # Images can be loaded from anywhere, though we'd like to deprecate this as it allows # the use of images for tracking. - imgSrc "'self' data: blob: https://your-main-domain.com" + imgSrc "'self' data: blob: https://your-main-domain.com" # frame-src specifies valid sources for nested browsing contexts. # This prevents loading any iframes from anywhere other than the sandbox domain. @@ -126,6 +126,23 @@ your-sandbox-domain.com:443 { path "*.mjs" } header @fileModuleJS Content-Type "application/javascript" + + # The Node.js process can handle all traffic, whether accessed over websocket or as static assets. + # We prefer to serve static content from Caddy directly, and to leave the API server to handle the + # the dynamic content that only it can manage. This is primarily for optimization. + handle /cryptpad_websocket/* { + reverse_proxy * { + to 127.0.0.1:3003 + header_up Host "{host}" + header_up X-Real-IP "{remote_host}" + + # Caddy supports WebSockets directly. No additional headers are needed. + + # Force Caddy to accept `X-Forwarded-For` and other origin headers. + # Modify the line below if you want to restrict the scope of direct downstream sending these headers. + trusted_proxies 0.0.0.0/0 ::/0 + } + } # Enable file serving file_server { From 0df91771d563186339e12a5e9da839bd25dfe2bc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lumi=C3=A8re=20=C3=89lev=C3=A9?= <88174309+PoneyClairDeLune@users.noreply.github.com> Date: Sat, 24 Aug 2024 09:12:21 +0100 Subject: [PATCH 03/14] Caddyfile: More reverse proxying --- docs/example-advanced.caddy.conf | 48 ++++++++++++++++++++++++++++---- 1 file changed, 43 insertions(+), 5 deletions(-) diff --git a/docs/example-advanced.caddy.conf b/docs/example-advanced.caddy.conf index bfdc22767..cdc860f7a 100644 --- a/docs/example-advanced.caddy.conf +++ b/docs/example-advanced.caddy.conf @@ -8,6 +8,12 @@ # installation (http server by the Nodejs process). If you are using CryptPad # in production and require professional support please contact sales@cryptpad.fr +@trustedProxies { + # Force Caddy to accept `X-Forwarded-For` and other origin headers. + # Modify the line below if you want to restrict the scope of direct downstream sending these headers. + trusted_proxies 0.0.0.0/0 ::/0 +} + # Caddy does not have variables for server names, so domains need to be hardcoded. # You can bulk replace "your-main-domain.com" and "your-sandbox-domain.com" safely. your-main-domain.com:443, @@ -126,7 +132,7 @@ your-sandbox-domain.com:443 { path "*.mjs" } header @fileModuleJS Content-Type "application/javascript" - + # The Node.js process can handle all traffic, whether accessed over websocket or as static assets. # We prefer to serve static content from Caddy directly, and to leave the API server to handle the # the dynamic content that only it can manage. This is primarily for optimization. @@ -135,12 +141,44 @@ your-sandbox-domain.com:443 { to 127.0.0.1:3003 header_up Host "{host}" header_up X-Real-IP "{remote_host}" - + # Caddy supports WebSockets directly. No additional headers are needed. - # Force Caddy to accept `X-Forwarded-For` and other origin headers. - # Modify the line below if you want to restrict the scope of direct downstream sending these headers. - trusted_proxies 0.0.0.0/0 ::/0 + import trustedProxies + } + } + + handle_path /customize.dist/* { + # This is needed in order to prevent infinite recursion between /customize/ and the root. + } + + # Try to load customizeable content via /customize/ and fall back to the default content located + # at /customize.dist/ . + # This is what allows you to override behaviour. + handle_path /customize/* { + try_files /customize/{path} /customize.dist/{path} + file_server { + index index.html index.htm default.html default.htm + } + } + + # /api/config is loaded once per page load, and is used to retrieve the caching variable, + # which is applied to every other resource loaded during that session. + @sharedReverseProxy { + path /api/* + path /extensions.js + } + handle @sharedReverseProxy { + reverse_proxy * { + to 127.0.0.1:3000 + header_up Host "{host}" + header_up X-Real-IP "{remote_host}" + + # These settings prevent both Caddy and the API server from setting duplicate headers. + header_down Cross-Origin-Resource-Policy cross-origin + header_down Cross-Origin-Embedder-Policy require-corp + + import trustedProxies } } From 2cde2a684bf01d86cec25f42832e383b6b2c6bb3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lumi=C3=A8re=20=C3=89lev=C3=A9?= <88174309+PoneyClairDeLune@users.noreply.github.com> Date: Sat, 24 Aug 2024 09:39:45 +0100 Subject: [PATCH 04/14] Caddyfile: blob, blocks, trailing slashes --- docs/example-advanced.caddy.conf | 56 +++++++++++++++++++++++++++++--- 1 file changed, 51 insertions(+), 5 deletions(-) diff --git a/docs/example-advanced.caddy.conf b/docs/example-advanced.caddy.conf index cdc860f7a..3f1593211 100644 --- a/docs/example-advanced.caddy.conf +++ b/docs/example-advanced.caddy.conf @@ -31,13 +31,19 @@ your-sandbox-domain.com:443 { header X-Content-Type-Options "nosniff" header Access-Control-Allow-Credentials "true" #header X-Frame-Options "SAMEORIGIN" + + # OnlyOffice fonts may be loaded from both domains. + @onlyOfficeFonts { + path_regexp "^\\/common\\/onlyoffice\\/.*\\/fonts\\/.*$" + } + header Access-Control-Allow-Origin "*" # By default CryptPad forbids remote domains from embedding CryptPad documents in iframes. # The sandbox domain must always be permitted in order for the platform to function. # If you wish to enable remote embedding you may change the value below to "*" # as per the commented value. - header Access-Control-Allow-Origin "https://your-sandbox-domain.com" - #header Access-Control-Allow-Origin "*" + header ?Access-Control-Allow-Origin "https://your-sandbox-domain.com" + #header ?Access-Control-Allow-Origin "*" # Opt out of Google's FLoC Network header Permissions-Policy "interest-cohort=()" @@ -120,9 +126,9 @@ your-sandbox-domain.com:443 { # Finally, set all the security rules you have composed above. @privilegedScope { host "your-sandbox-domain.com" - path_regexp "^\\/(sheet|doc|presentation)\\/inner.html.*$)" - path_regexp "^\\/common\\/onlyoffice\\/.*\\/.*\\.html.*$)" - path_regexp "^\\/unsafeiframe\\/inner\\.html.*$)" + path_regexp "^\\/(sheet|doc|presentation)\\/inner.html.*$" + path_regexp "^\\/common\\/onlyoffice\\/.*\\/.*\\.html.*$" + path_regexp "^\\/unsafeiframe\\/inner\\.html.*$" } header @privilegedScope Content-Security-Policy "default-src 'none'; child-src {vars.childSrc}; worker-src {vars.workerSrc}; media-src {vars.mediaSrc}; style-src {vars.styleSrc}; script-src {vars.scriptSrcUnsafe}; connect-src {vars.connectSrc}; font-src {vars.fontSrc}; img-src {vars.imgSrc}; frame-src {vars.frameSrc}; frame-ancestors {vars.frameAncestors}" header ?Content-Security-Policy "default-src 'none'; child-src {vars.childSrc}; worker-src {vars.workerSrc}; media-src {vars.mediaSrc}; style-src {vars.styleSrc}; script-src {vars.scriptSrc}; connect-src {vars.connectSrc}; font-src {vars.fontSrc}; img-src {vars.imgSrc}; frame-src {vars.frameSrc}; frame-ancestors {vars.frameAncestors}" @@ -182,6 +188,46 @@ your-sandbox-domain.com:443 { } } + # Requests for blobs and blocks are now proxied to the API server. + # This simplifies Caddy path configuration, in the event they are being hosted in a non-standard location + # or with odd unexpected permissions. Serving blobs in this manner also means that it will be possible to + # enforce access control for them, though this is not yet implemented. + # Access control (via TOTP 2FA) has been added to blocks, so they can be handled with the same directives. + @blobsAndBlocks { + path /blob/* + path /block/* + } + handle @blobsAndBlocks { + @corsPreflight { + method OPTIONS + header Access-Control-Allow-Origin "https://your-sandbox-domain.com" + header Access-Control-Allow-Credentials "true" + header Access-Control-Allow-Methods "GET, POST, OPTIONS" + header Access-Control-Allow-Headers "DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range" + header Access-Control-Max-Age "1728000" + header Content-Type "application/octet-stream; charset=utf-8" + header Content-Length "0" + respond 204 + } + reverse_proxy * { + to 127.0.0.1:3000 + # Preventing these headers from getting duplicated, since we are proxying to the API server. + header_down -X-Content-Type-Options + header_down -Access-Control-Allow-Origin + header_down -Permissions-Policy + header_down -X-XSS-Protection + header_down -Cross-Origin-Resource-Policy + header_down -Cross-Origin-Embedder-Policy + } + } + + # The Node.JS server has some built-in forwarding rulesets to prevent URLs not suffixed with a slash + # from resulting in a 404 error. This simply adds a trailing slash to a variety of applications. + @preventNotFound { + path_regexp "^/(register|login|recovery|settings|user|pad|drive|poll|slide|code|whiteboard|file|media|profile|contacts|todo|filepicker|debug|kanban|sheet|support|admin|notifications|teams|calendar|presentation|doc|form|report|convert|checkup|diagram)$" + } + redir @preventNotFound "{path}/" + # Enable file serving file_server { index index.html index.htm default.html default.htm From 07b75d73cdbf6a85bbf84bcff24ad8eeb554964f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lumi=C3=A8re=20=C3=89lev=C3=A9?= <88174309+PoneyClairDeLune@users.noreply.github.com> Date: Sat, 24 Aug 2024 09:43:07 +0100 Subject: [PATCH 05/14] Caddyfile: Well it's 2024 now --- docs/example-advanced.caddy.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/example-advanced.caddy.conf b/docs/example-advanced.caddy.conf index 3f1593211..db15d6141 100644 --- a/docs/example-advanced.caddy.conf +++ b/docs/example-advanced.caddy.conf @@ -1,4 +1,4 @@ -# SPDX-FileCopyrightText: 2023 XWiki CryptPad Team and contributors +# SPDX-FileCopyrightText: 2024 XWiki CryptPad Team and contributors # # SPDX-License-Identifier: AGPL-3.0-or-later From 3011d917d2037d1b0eb4be47d0ff836c85aee921 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lumi=C3=A8re=20=C3=89lev=C3=A9?= <88174309+PoneyClairDeLune@users.noreply.github.com> Date: Sat, 24 Aug 2024 18:18:41 +0100 Subject: [PATCH 06/14] Caddyfile: Prevent COxP header duplication --- docs/example-advanced.caddy.conf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/example-advanced.caddy.conf b/docs/example-advanced.caddy.conf index db15d6141..b75a7f53c 100644 --- a/docs/example-advanced.caddy.conf +++ b/docs/example-advanced.caddy.conf @@ -49,8 +49,8 @@ your-sandbox-domain.com:443 { header Permissions-Policy "interest-cohort=()" # Enable SharedArrayBuffer in Firefox (for .xlsx export) - header Cross-Origin-Resource-Policy "cross-origin" - header Cross-Origin-Embedder-Policy "require-corp" + header ?Cross-Origin-Resource-Policy "cross-origin" + header ?Cross-Origin-Embedder-Policy "require-corp" # Specify the relative path to root of your custom error page. # This error page won't only be served for 404 errors. From f82a542db35e7b3752630f63c66c590a6c36d060 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lumi=C3=A8re=20=C3=89lev=C3=A9?= <88174309+PoneyClairDeLune@users.noreply.github.com> Date: Sat, 24 Aug 2024 19:35:03 +0100 Subject: [PATCH 07/14] Caddyfile: No global matchers --- docs/example-advanced.caddy.conf | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/example-advanced.caddy.conf b/docs/example-advanced.caddy.conf index b75a7f53c..08103623c 100644 --- a/docs/example-advanced.caddy.conf +++ b/docs/example-advanced.caddy.conf @@ -8,12 +8,6 @@ # installation (http server by the Nodejs process). If you are using CryptPad # in production and require professional support please contact sales@cryptpad.fr -@trustedProxies { - # Force Caddy to accept `X-Forwarded-For` and other origin headers. - # Modify the line below if you want to restrict the scope of direct downstream sending these headers. - trusted_proxies 0.0.0.0/0 ::/0 -} - # Caddy does not have variables for server names, so domains need to be hardcoded. # You can bulk replace "your-main-domain.com" and "your-sandbox-domain.com" safely. your-main-domain.com:443, @@ -139,6 +133,12 @@ your-sandbox-domain.com:443 { } header @fileModuleJS Content-Type "application/javascript" + @trustedProxies { + # Force Caddy to accept `X-Forwarded-For` and other origin headers. + # Modify the line below if you want to restrict the scope of direct downstream sending these headers. + trusted_proxies 0.0.0.0/0 ::/0 + } + # The Node.js process can handle all traffic, whether accessed over websocket or as static assets. # We prefer to serve static content from Caddy directly, and to leave the API server to handle the # the dynamic content that only it can manage. This is primarily for optimization. From a5095966e5f195114a32ff59aee54598907b89c1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lumi=C3=A8re=20=C3=89lev=C3=A9?= <88174309+PoneyClairDeLune@users.noreply.github.com> Date: Sat, 24 Aug 2024 19:37:47 +0100 Subject: [PATCH 08/14] Caddyfile: Oops, should be imports --- docs/example-advanced.caddy.conf | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/example-advanced.caddy.conf b/docs/example-advanced.caddy.conf index 08103623c..a4c41d0eb 100644 --- a/docs/example-advanced.caddy.conf +++ b/docs/example-advanced.caddy.conf @@ -8,6 +8,12 @@ # installation (http server by the Nodejs process). If you are using CryptPad # in production and require professional support please contact sales@cryptpad.fr +(trustedProxies) { + # Force Caddy to accept `X-Forwarded-For` and other origin headers. + # Modify the line below if you want to restrict the scope of direct downstream sending these headers. + trusted_proxies 0.0.0.0/0 ::/0 +} + # Caddy does not have variables for server names, so domains need to be hardcoded. # You can bulk replace "your-main-domain.com" and "your-sandbox-domain.com" safely. your-main-domain.com:443, @@ -133,12 +139,6 @@ your-sandbox-domain.com:443 { } header @fileModuleJS Content-Type "application/javascript" - @trustedProxies { - # Force Caddy to accept `X-Forwarded-For` and other origin headers. - # Modify the line below if you want to restrict the scope of direct downstream sending these headers. - trusted_proxies 0.0.0.0/0 ::/0 - } - # The Node.js process can handle all traffic, whether accessed over websocket or as static assets. # We prefer to serve static content from Caddy directly, and to leave the API server to handle the # the dynamic content that only it can manage. This is primarily for optimization. From 7fff13850f114331117b7775ba7c7300442bf928 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lumi=C3=A8re=20=C3=89lev=C3=A9?= <88174309+PoneyClairDeLune@users.noreply.github.com> Date: Sat, 24 Aug 2024 19:41:55 +0100 Subject: [PATCH 09/14] Caddyfile: Split privileged scope --- docs/example-advanced.caddy.conf | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/docs/example-advanced.caddy.conf b/docs/example-advanced.caddy.conf index a4c41d0eb..d6976be18 100644 --- a/docs/example-advanced.caddy.conf +++ b/docs/example-advanced.caddy.conf @@ -124,13 +124,21 @@ your-sandbox-domain.com:443 { } # Finally, set all the security rules you have composed above. - @privilegedScope { + @privilegedScope1 { host "your-sandbox-domain.com" path_regexp "^\\/(sheet|doc|presentation)\\/inner.html.*$" + } + @privilegedScope2 { + host "your-sandbox-domain.com" path_regexp "^\\/common\\/onlyoffice\\/.*\\/.*\\.html.*$" + } + @privilegedScope3 { + host "your-sandbox-domain.com" path_regexp "^\\/unsafeiframe\\/inner\\.html.*$" } - header @privilegedScope Content-Security-Policy "default-src 'none'; child-src {vars.childSrc}; worker-src {vars.workerSrc}; media-src {vars.mediaSrc}; style-src {vars.styleSrc}; script-src {vars.scriptSrcUnsafe}; connect-src {vars.connectSrc}; font-src {vars.fontSrc}; img-src {vars.imgSrc}; frame-src {vars.frameSrc}; frame-ancestors {vars.frameAncestors}" + header @privilegedScope1 Content-Security-Policy "default-src 'none'; child-src {vars.childSrc}; worker-src {vars.workerSrc}; media-src {vars.mediaSrc}; style-src {vars.styleSrc}; script-src {vars.scriptSrcUnsafe}; connect-src {vars.connectSrc}; font-src {vars.fontSrc}; img-src {vars.imgSrc}; frame-src {vars.frameSrc}; frame-ancestors {vars.frameAncestors}" + header @privilegedScope2 Content-Security-Policy "default-src 'none'; child-src {vars.childSrc}; worker-src {vars.workerSrc}; media-src {vars.mediaSrc}; style-src {vars.styleSrc}; script-src {vars.scriptSrcUnsafe}; connect-src {vars.connectSrc}; font-src {vars.fontSrc}; img-src {vars.imgSrc}; frame-src {vars.frameSrc}; frame-ancestors {vars.frameAncestors}" + header @privilegedScope3 Content-Security-Policy "default-src 'none'; child-src {vars.childSrc}; worker-src {vars.workerSrc}; media-src {vars.mediaSrc}; style-src {vars.styleSrc}; script-src {vars.scriptSrcUnsafe}; connect-src {vars.connectSrc}; font-src {vars.fontSrc}; img-src {vars.imgSrc}; frame-src {vars.frameSrc}; frame-ancestors {vars.frameAncestors}" header ?Content-Security-Policy "default-src 'none'; child-src {vars.childSrc}; worker-src {vars.workerSrc}; media-src {vars.mediaSrc}; style-src {vars.styleSrc}; script-src {vars.scriptSrc}; connect-src {vars.connectSrc}; font-src {vars.fontSrc}; img-src {vars.imgSrc}; frame-src {vars.frameSrc}; frame-ancestors {vars.frameAncestors}" # Add support for .mjs files used by pdfjs From d58b5125b897a98223786ec98430ddedb6e0ec12 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lumi=C3=A8re=20=C3=89lev=C3=A9?= <88174309+PoneyClairDeLune@users.noreply.github.com> Date: Sat, 24 Aug 2024 19:47:30 +0100 Subject: [PATCH 10/14] Caddyfile: Corrected CORS preflight response --- docs/example-advanced.caddy.conf | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/example-advanced.caddy.conf b/docs/example-advanced.caddy.conf index d6976be18..25081d088 100644 --- a/docs/example-advanced.caddy.conf +++ b/docs/example-advanced.caddy.conf @@ -208,6 +208,8 @@ your-sandbox-domain.com:443 { handle @blobsAndBlocks { @corsPreflight { method OPTIONS + } + handle @corsPreflight { header Access-Control-Allow-Origin "https://your-sandbox-domain.com" header Access-Control-Allow-Credentials "true" header Access-Control-Allow-Methods "GET, POST, OPTIONS" From f2014c4d6c592e8953cf06e5fa43e6700b8753c8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lumi=C3=A8re=20=C3=89lev=C3=A9?= <88174309+PoneyClairDeLune@users.noreply.github.com> Date: Sat, 24 Aug 2024 20:01:22 +0100 Subject: [PATCH 11/14] Caddyfile: A simpler config, container oriented --- docs/example.caddy.conf | 67 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 67 insertions(+) create mode 100644 docs/example.caddy.conf diff --git a/docs/example.caddy.conf b/docs/example.caddy.conf new file mode 100644 index 000000000..d1e66a743 --- /dev/null +++ b/docs/example.caddy.conf @@ -0,0 +1,67 @@ +# SPDX-FileCopyrightText: 2024 XWiki CryptPad Team and contributors +# +# SPDX-License-Identifier: AGPL-3.0-or-later + +# This file is included strictly as an example of how Caddy can be configured +# to work with CryptPad. This example WILL NOT WORK AS IS. For best results, +# compare the sections of this configuration file against a working CryptPad +# installation (http server by the Nodejs process). If you are using CryptPad +# in production and require professional support please contact sales@cryptpad.fr + +(trustedProxies) { + # Force Caddy to accept `X-Forwarded-For` and other origin headers. + # Modify the line below if you want to restrict the scope of direct downstream sending these headers. + trusted_proxies 0.0.0.0/0 ::/0 +} + +# Caddy does not have variables for server names, so domains need to be hardcoded. +# You can bulk replace "your-main-domain.com" and "your-sandbox-domain.com" safely. +your-main-domain.com:443, +your-sandbox-domain.com:443 { + # Define your certificates below. + # No need to adjust TLS configurations, as the defaults in Caddy are already secure. + tls /path/to/fullchain/publicKey.pem /path/to/certificate/privateKey.pem + + # Enable HSTS. + # Do not enable this line when configuring over mixnet, e.g. Tor. + header Strict-Transport-Security "max-age=63072000; includeSubDomains" + + # Opt out of Google's FLoC Network + header Permissions-Policy "interest-cohort=()" + + # Specify the relative path to root of your custom error page. + # This error page won't only be served for 404 errors. + handle_errors { + rewrite * /error.htm + header Cache-Control "no-cache, no-store" + file_server + templates + } + + # The Node.js process can handle all traffic, whether accessed over websocket or as static assets. + reverse_proxy /cryptpad_websocket/* { + to 127.0.0.1:3003 + header_up Host "{host}" + header_up X-Real-IP "{remote_host}" + + # Caddy supports WebSockets directly. No additional headers are needed. + + import trustedProxies + } + reverse_proxy * { + to 127.0.0.1:3000 + header_up Host "{host}" + header_up X-Real-IP "{remote_host}" + + # These settings prevent both Caddy and the API server from setting duplicate headers. + header_down Cross-Origin-Resource-Policy cross-origin + header_down Cross-Origin-Embedder-Policy require-corp + + import trustedProxies + } + + # Enable file serving + file_server { + index index.html index.htm default.html default.htm + } +} From f7e9352d8f2081c5c525e8000ab62f8f365dda18 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lumi=C3=A8re=20=C3=89lev=C3=A9?= <88174309+PoneyClairDeLune@users.noreply.github.com> Date: Sat, 24 Aug 2024 20:29:22 +0100 Subject: [PATCH 12/14] Caddyfile: Remove duplicate headers --- docs/example.caddy.conf | 3 --- 1 file changed, 3 deletions(-) diff --git a/docs/example.caddy.conf b/docs/example.caddy.conf index d1e66a743..4363dbb18 100644 --- a/docs/example.caddy.conf +++ b/docs/example.caddy.conf @@ -26,9 +26,6 @@ your-sandbox-domain.com:443 { # Do not enable this line when configuring over mixnet, e.g. Tor. header Strict-Transport-Security "max-age=63072000; includeSubDomains" - # Opt out of Google's FLoC Network - header Permissions-Policy "interest-cohort=()" - # Specify the relative path to root of your custom error page. # This error page won't only be served for 404 errors. handle_errors { From 5b342964df03ec6c64b8e9efab9731408e17cff5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lumi=C3=A8re=20=C3=89lev=C3=A9?= <88174309+PoneyClairDeLune@users.noreply.github.com> Date: Tue, 3 Sep 2024 17:08:40 +0100 Subject: [PATCH 13/14] Name change and move --- docs/{ => community}/example.caddy.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename docs/{ => community}/example.caddy.conf (99%) diff --git a/docs/example.caddy.conf b/docs/community/example.caddy.conf similarity index 99% rename from docs/example.caddy.conf rename to docs/community/example.caddy.conf index 4363dbb18..1f17cb9fc 100644 --- a/docs/example.caddy.conf +++ b/docs/community/example.caddy.conf @@ -6,7 +6,7 @@ # to work with CryptPad. This example WILL NOT WORK AS IS. For best results, # compare the sections of this configuration file against a working CryptPad # installation (http server by the Nodejs process). If you are using CryptPad -# in production and require professional support please contact sales@cryptpad.fr +# in production and require professional support please contact sales@cryptpad.org (trustedProxies) { # Force Caddy to accept `X-Forwarded-For` and other origin headers. From e47e83532459b144e735780d2fe4ded7239ec22a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lumi=C3=A8re=20=C3=89lev=C3=A9?= <88174309+PoneyClairDeLune@users.noreply.github.com> Date: Tue, 3 Sep 2024 17:09:24 +0100 Subject: [PATCH 14/14] Email change and move --- docs/{ => community}/example-advanced.caddy.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename docs/{ => community}/example-advanced.caddy.conf (99%) diff --git a/docs/example-advanced.caddy.conf b/docs/community/example-advanced.caddy.conf similarity index 99% rename from docs/example-advanced.caddy.conf rename to docs/community/example-advanced.caddy.conf index 25081d088..2aecda43e 100644 --- a/docs/example-advanced.caddy.conf +++ b/docs/community/example-advanced.caddy.conf @@ -6,7 +6,7 @@ # to work with CryptPad. This example WILL NOT WORK AS IS. For best results, # compare the sections of this configuration file against a working CryptPad # installation (http server by the Nodejs process). If you are using CryptPad -# in production and require professional support please contact sales@cryptpad.fr +# in production and require professional support please contact sales@cryptpad.org (trustedProxies) { # Force Caddy to accept `X-Forwarded-For` and other origin headers.