b3d876fa85
- compression_concurrency wired to boot config (state.rs) and removed as a dead admin control. - patch_config gains per-key integer/range validation so numerically-valid-but- nonsensical values (-1/NaN/3.5) are rejected instead of silently reverting to default at read time. - clearAuth now also clears the display name (shared-device residual). - e2e/Caddyfile.test mirrors prod security headers + the SSE encode-exclusion so the test stack is representative and can catch header regressions. - .gitignore: ignore root-level Playwright artifacts (test-results/, report). - docs: USER_JOURNEYS §10 and SECURITY-BACKLOG updated to match the implemented read-only-ban behavior and the export-path fix. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
25 lines
878 B
Caddyfile
25 lines
878 B
Caddyfile
# Caddyfile used only by the E2E test stack. Listens on the in-container :3101
|
|
# (mapped to host :3101) and proxies API + media to the backend, everything else
|
|
# to the SvelteKit frontend container — same layout as production but stripped
|
|
# of HTTPS/Let's Encrypt.
|
|
|
|
:3101 {
|
|
# Mirror prod: exclude the SSE stream from compression so buffering doesn't
|
|
# delay real-time events (and so the test stack exercises the real behavior).
|
|
@compressible not path /api/v1/stream
|
|
encode @compressible zstd gzip
|
|
|
|
# Mirror prod's security headers (minus HSTS, which is HTTPS-only).
|
|
header {
|
|
X-Content-Type-Options "nosniff"
|
|
X-Frame-Options "DENY"
|
|
Referrer-Policy "strict-origin-when-cross-origin"
|
|
}
|
|
|
|
reverse_proxy /api/* app:3000
|
|
reverse_proxy /media/* app:3000
|
|
reverse_proxy /health app:3000
|
|
|
|
reverse_proxy frontend:3001
|
|
}
|