60 lines
1.7 KiB
Text
60 lines
1.7 KiB
Text
|
# Caddy reverse proxy for the DGB RPC backend.
|
||
|
|
# Terminates TLS via Let's Encrypt. Proxies to Core RPC on localhost:14022.
|
||
|
|
# Rate-limits per client IP. Forwards Authorization header for Core basic auth.
|
||
|
|
#
|
||
|
|
# The @DOMAIN@ token is substituted by setup.sh.
|
||
|
|
|
||
|
|
@DOMAIN@ {
|
||
|
|
encode zstd gzip
|
||
|
|
|
||
|
|
# Basic security hardening for the endpoint
|
||
|
|
header {
|
||
|
|
# No caching of RPC responses
|
||
|
|
Cache-Control "no-store"
|
||
|
|
# Disable browser MIME sniffing
|
||
|
|
X-Content-Type-Options "nosniff"
|
||
|
|
# No referrer bleed
|
||
|
|
Referrer-Policy "no-referrer"
|
||
|
|
# Strict transport security (2 years)
|
||
|
|
Strict-Transport-Security "max-age=63072000; includeSubDomains"
|
||
|
|
# Remove server identification
|
||
|
|
-Server
|
||
|
|
}
|
||
|
|
|
||
|
|
# Rate limit — 60 requests per minute per IP, per remote endpoint.
|
||
|
|
# Requires github.com/mholt/caddy-ratelimit plugin.
|
||
|
|
rate_limit {
|
||
|
|
zone rpc_zone {
|
||
|
|
key {client.ip}
|
||
|
|
events 60
|
||
|
|
window 1m
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
# Only POST (JSON-RPC). Reject everything else.
|
||
|
|
@not_post {
|
||
|
|
not method POST
|
||
|
|
}
|
||
|
|
respond @not_post "Method Not Allowed" 405
|
||
|
|
|
||
|
|
# Proxy JSON-RPC to Core. Basic-auth is passed through unchanged;
|
||
|
|
# Core validates rpcuser/rpcpassword against digibyte.conf.
|
||
|
|
reverse_proxy 127.0.0.1:14022 {
|
||
|
|
header_up Host {host}
|
||
|
|
header_up X-Real-IP {remote}
|
||
|
|
header_up X-Forwarded-For {remote}
|
||
|
|
header_up X-Forwarded-Proto {scheme}
|
||
|
|
transport http {
|
||
|
|
keepalive 30s
|
||
|
|
keepalive_idle_conns 8
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
# Structured access log; journalctl -u caddy
|
||
|
|
log {
|
||
|
|
output stdout
|
||
|
|
format json
|
||
|
|
level INFO
|
||
|
|
}
|
||
|
|
}
|