d50286a9a5
Packages: core (BIP39/32/44/49/84/86 derivation, WIF), keystore (PBKDF2 + AES-GCM), psbt, p2p (BIP157/158 SPV daemon, Dandelion++ broadcast with relay-echo verification), blockbook, rpc, electrum, net, bns, web-ui (React/Vite), mobile (Expo). ops/ holds the nginx vhost, systemd unit and push.sh deploy script for digibyte.x/web.
58 lines
1.4 KiB
Text
58 lines
1.4 KiB
Text
# Caddy reverse proxy — BNS/self-signed variant.
|
|
# TLS uses an on-disk cert whose SHA-256 is pinned on-chain (@dgb-wallet/bns).
|
|
# No ACME, no Let's Encrypt, no domain validation.
|
|
#
|
|
# Tokens replaced by ops/setup.sh:
|
|
# @BNS_NAME@ the BNS name (e.g. rpc.dgb)
|
|
# @CERT_FILE@ path to server.crt
|
|
# @KEY_FILE@ path to server.key
|
|
|
|
{
|
|
auto_https off
|
|
}
|
|
|
|
:443 {
|
|
tls @CERT_FILE@ @KEY_FILE@
|
|
|
|
encode zstd gzip
|
|
|
|
header {
|
|
Cache-Control "no-store"
|
|
X-Content-Type-Options "nosniff"
|
|
Referrer-Policy "no-referrer"
|
|
-Server
|
|
}
|
|
|
|
# Rate limit — 60 requests/min per IP. Requires caddy-ratelimit plugin.
|
|
# (Kept as a rate_limit block; if caddy is compiled without the plugin,
|
|
# comment this block out and rely on Core's rpcworkqueue + fail2ban.)
|
|
# rate_limit {
|
|
# zone rpc_zone {
|
|
# key {client.ip}
|
|
# events 60
|
|
# window 1m
|
|
# }
|
|
# }
|
|
|
|
@not_post {
|
|
not method POST
|
|
}
|
|
respond @not_post "Method Not Allowed" 405
|
|
|
|
reverse_proxy 127.0.0.1:14022 {
|
|
header_up Host {host}
|
|
header_up X-Real-IP {remote}
|
|
header_up X-Forwarded-For {remote}
|
|
header_up X-Forwarded-Proto {scheme}
|
|
transport http {
|
|
keepalive 30s
|
|
keepalive_idle_conns 8
|
|
}
|
|
}
|
|
|
|
log {
|
|
output stdout
|
|
format json
|
|
level INFO
|
|
}
|
|
}
|