# HiveGrid Website — Production Reverse Proxy
#
# Cloudflare Origin Certificate for TLS (SSL mode: Full).
# Cert is issued by Cloudflare, trusted only by Cloudflare edge.

:443 {
	tls /etc/caddy/origin.pem /etc/caddy/origin.key

	header {
		Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
		X-Content-Type-Options "nosniff"
		X-Frame-Options "DENY"
		Referrer-Policy "strict-origin-when-cross-origin"
		Permissions-Policy "camera=(), microphone=(), geolocation=()"
		X-XSS-Protection "0"
	}

	reverse_proxy web:3000
}

:80 {
	reverse_proxy web:3000
}
