9067225945
Adds defense-in-depth HTTP headers to the dev and prod Caddyfiles. CSP,
X-Frame-Options, Permissions-Policy, and Cache-Control: no-store apply
to the dashboard SPA (/admin/*) and admin API (/api/v1/admin/*). nosniff
and Referrer-Policy apply to every response (a sane default). HSTS is
unconditional in prod.
User-route responses (the catch-all `handle`) deliberately get NO CSP —
user scripts own their own response headers by design.
The CSP / X-Frame-Options / Cache-Control / Permissions-Policy headers
use the `?` operator ("set only if not already present") so application
responses with their own restrictive policy — notably the audit C-2
file-download handler, which sends a sandboxed CSP — win over Caddy's
defaults.
This downgrades H-A4 (dashboard token in localStorage) from acute to
defense-in-depth: with this CSP and no inline JS in the dashboard,
XSS-based token exfiltration is no longer a one-step exploit.
Validated with `caddy validate` (docker caddy:2-alpine) for both files;
also `caddy fmt --overwrite`'d.
Audit ref: security_audit/07_http_cors_csrf_xss.md (H07-03/04/05 +
M07-06/07/08/09).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
82 lines
2.5 KiB
Caddyfile
82 lines
2.5 KiB
Caddyfile
# PiCloud production Caddyfile.
|
|
#
|
|
# Set PICLOUD_DOMAIN and PICLOUD_ADMIN_EMAIL in the environment Caddy is
|
|
# started from (docker-compose.prod.yml passes them through). Caddy then
|
|
# obtains and renews a Let's Encrypt cert automatically for that domain.
|
|
#
|
|
# Audit 2026-06-11 (H-A1/2/3/5, M07-06/07/08/09): defense-in-depth
|
|
# headers. HSTS lands on every prod response. CSP, X-Frame-Options,
|
|
# Permissions-Policy, and Cache-Control: no-store land on the dashboard
|
|
# SPA and admin API. nosniff + Referrer-Policy land everywhere. User-
|
|
# route responses (catch-all `handle`) deliberately get NO CSP — user
|
|
# scripts own their own response headers by design.
|
|
# `?` operator = "default if missing" so downstream responses (e.g. the
|
|
# file-download endpoint with its own restrictive CSP) win.
|
|
{
|
|
email {$PICLOUD_ADMIN_EMAIL}
|
|
}
|
|
|
|
{$PICLOUD_DOMAIN} {
|
|
encode zstd gzip
|
|
|
|
# Baseline headers on every response. HSTS is unconditional in prod.
|
|
header {
|
|
Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
|
|
X-Content-Type-Options "nosniff"
|
|
Referrer-Policy "no-referrer"
|
|
}
|
|
|
|
handle /healthz {
|
|
reverse_proxy picloud:8080
|
|
}
|
|
handle /version {
|
|
reverse_proxy picloud:8080
|
|
}
|
|
|
|
handle /api/v1/admin/* {
|
|
header {
|
|
?Content-Security-Policy "default-src 'none'; frame-ancestors 'none'; base-uri 'none'"
|
|
?X-Frame-Options "DENY"
|
|
?Cache-Control "no-store"
|
|
?Permissions-Policy "geolocation=(), camera=(), microphone=(), payment=(), usb=(), accelerometer=(), gyroscope=()"
|
|
}
|
|
reverse_proxy picloud:8080
|
|
}
|
|
handle /api/v1/execute/* {
|
|
reverse_proxy picloud:8080
|
|
}
|
|
|
|
handle /api/* {
|
|
respond 404 {
|
|
body "{\"error\":\"no such API version — see /version for supported routes\"}"
|
|
close
|
|
}
|
|
}
|
|
|
|
handle /admin/* {
|
|
header {
|
|
?Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'"
|
|
?X-Frame-Options "DENY"
|
|
?Cache-Control "no-store"
|
|
?Permissions-Policy "geolocation=(), camera=(), microphone=(), payment=(), usb=(), accelerometer=(), gyroscope=()"
|
|
}
|
|
reverse_proxy dashboard:80
|
|
}
|
|
handle /admin {
|
|
header {
|
|
?Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'"
|
|
?X-Frame-Options "DENY"
|
|
}
|
|
reverse_proxy dashboard:80
|
|
}
|
|
|
|
handle {
|
|
reverse_proxy picloud:8080
|
|
}
|
|
|
|
log {
|
|
output stdout
|
|
format json
|
|
}
|
|
}
|