Caddyfile

{
	# Admin API — only listen on internal overlay network for Prometheus scraping
	admin 0.0.0.0:2019 {
		origins 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 127.0.0.1
	}
	servers {
		metrics
	}
}

# ─── Wazuh Dashboard — truy cập trực tiếp qua WireGuard VPN ───────────────
# URL: http://10.200.0.1:5601/wazuh/
# Không basic_auth (WireGuard là lớp auth), không CSP override
# Cloudflare không xử lý traffic VPN → không inject beacon.js
http://10.200.0.1:5601 {
	reverse_proxy wazuh-dashboard:5601 {
		transport http {
			tls_insecure_skip_verify
		}
	}
}

natra.site {
	# Health checks (no auth required)
	handle /health/* {
		reverse_proxy api:8080
	}

	# Grafana — monitoring dashboard (basic auth protected)
	handle /grafana* {
		basic_auth {
			monitor $2b$12$i27omGvrtGdYIh93svxdZO6.BJRMU6a1Y//ZjK7qMqBSV2E/9srIC
		}
		reverse_proxy ivf-grafana:3000
	}

	# Prometheus — metrics (basic auth protected, proxied with upstream auth)
	handle /prometheus* {
		basic_auth {
			monitor $2b$12$i27omGvrtGdYIh93svxdZO6.BJRMU6a1Y//ZjK7qMqBSV2E/9srIC
		}
		reverse_proxy ivf-prometheus:9090 {
			header_up Authorization "Basic bW9uaXRvcjp3RERhSTh6elNUQlB5emZHcDN3UmM2SmtER2dJdjZaRg=="
		}
	}

	# Loki — log aggregation (basic auth protected, strip /loki prefix)
	handle_path /loki/* {
		basic_auth {
			monitor $2b$12$i27omGvrtGdYIh93svxdZO6.BJRMU6a1Y//ZjK7qMqBSV2E/9srIC
		}
		reverse_proxy ivf-loki:3100
	}
	handle /loki {
		redir /loki/ permanent
	}
	# Wazuh Dashboard — SIEM security monitoring (basic auth protected)
	# Public assets: UI static files, bootstrap.js, and webpack bundles (versioned /49201/bundles/)
	# skip basic_auth — browsers may not send cached credentials for dynamically-loaded scripts
	@wazuh_public {
		path /wazuh/ui/* /wazuh/bootstrap.js /wazuh/*/bundles/*
	}
	handle @wazuh_public {
		reverse_proxy wazuh-dashboard:5601 {
			header_up -Authorization
			transport http {
				tls_insecure_skip_verify
			}
		}
	}
	# App pages and API — basic auth required
	# Let OSD handle its own CSP natively (verified working via WireGuard)
	handle /wazuh* {
		basic_auth {
			monitor $2b$12$i27omGvrtGdYIh93svxdZO6.BJRMU6a1Y//ZjK7qMqBSV2E/9srIC
		}
		reverse_proxy wazuh-dashboard:5601 {
			# Strip Caddy basic-auth credential so OpenSearch Security
			# does not try to authenticate the 'monitor' system user
			header_up -Authorization
			transport http {
				tls_insecure_skip_verify
			}
		}
	}
	handle /wazuh {
		redir /wazuh/ permanent
	}
	# MinIO Console — access via SSH tunnel only:
	# ssh -L 9001:localhost:9001 root@45.134.226.56
	# Then open http://localhost:9001

	# API requests
	handle /api/* {
		# Limit request body (10MB) to prevent resource exhaustion
		request_body {
			max_size 10MB
		}
		reverse_proxy api:8080 {
			health_uri      /health/live
			health_interval 15s
			health_timeout  5s
			fail_duration   30s
			lb_policy       round_robin
			lb_retries      2
		}
	}

	# SignalR hubs
	handle /hubs/* {
		reverse_proxy api:8080 {
			health_uri      /health/live
			health_interval 15s
			health_timeout  5s
			fail_duration   30s
			lb_policy       ip_hash
			header_up Connection {http.request.header.Connection}
			header_up Upgrade    {http.request.header.Upgrade}
		}
	}

	# SECURITY: Swagger not proxied in production (API gates via IsDevelopment())

	# Everything else -> Angular frontend
	handle {
		reverse_proxy frontend:80 {
			health_uri      /
			health_interval 30s
			health_timeout  5s
			fail_duration   30s
		}
	}

	# Security headers (aligned with API-level OWASP headers)
	header {
		X-Content-Type-Options nosniff
		X-Frame-Options DENY
		X-XSS-Protection "0"
		Referrer-Policy no-referrer
		Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
		Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=(), accelerometer=(), gyroscope=(), magnetometer=(), autoplay=(), display-capture=(), document-domain=(), fullscreen=(self), publickey-credentials-get=(self)"
		Cross-Origin-Embedder-Policy unsafe-none
		Cross-Origin-Opener-Policy same-origin
		Cross-Origin-Resource-Policy same-origin
		X-Permitted-Cross-Domain-Policies none
		X-Download-Options noopen
		X-DNS-Prefetch-Control off
		-Server
		-X-Powered-By
	}
	# CSP is route-scoped: strict policy everywhere except /wazuh* (needs unsafe-eval + manifest-src)
	@not_wazuh not path /wazuh*
	header @not_wazuh Content-Security-Policy "default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' data: blob:; font-src 'self' data: https://fonts.gstatic.com; connect-src 'self' wss: ws: https://api.ipify.org; frame-src 'self' blob:; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'self' blob:; upgrade-insecure-requests"

	encode gzip zstd
}

# md.natra.site — Tenant subdomain (Cloudflare proxied)
md.natra.site {
	# Health checks
	handle /health/* {
		reverse_proxy api:8080
	}

	# API requests
	handle /api/* {
		request_body {
			max_size 10MB
		}
		reverse_proxy api:8080 {
			health_uri      /health/live
			health_interval 15s
			health_timeout  5s
			fail_duration   30s
			lb_policy       round_robin
			lb_retries      2
		}
	}

	# SignalR hubs
	handle /hubs/* {
		reverse_proxy api:8080 {
			health_uri      /health/live
			health_interval 15s
			health_timeout  5s
			fail_duration   30s
			lb_policy       ip_hash
			header_up Connection {http.request.header.Connection}
			header_up Upgrade    {http.request.header.Upgrade}
		}
	}

	# Everything else -> Angular frontend
	handle {
		reverse_proxy frontend:80 {
			health_uri      /
			health_interval 30s
			health_timeout  5s
			fail_duration   30s
		}
	}

	# Security headers
	header {
		X-Content-Type-Options nosniff
		X-Frame-Options DENY
		X-XSS-Protection "0"
		Referrer-Policy no-referrer
		Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
		Content-Security-Policy "default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' data: blob:; font-src 'self' data: https://fonts.gstatic.com; connect-src 'self' wss: ws: https://api.ipify.org; frame-src 'self' blob:; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'self' blob:; upgrade-insecure-requests"
		Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=(), accelerometer=(), gyroscope=(), magnetometer=(), autoplay=(), display-capture=(), document-domain=(), fullscreen=(self), publickey-credentials-get=(self)"
		Cross-Origin-Embedder-Policy unsafe-none
		Cross-Origin-Opener-Policy same-origin
		Cross-Origin-Resource-Policy same-origin
		X-Permitted-Cross-Domain-Policies none
		X-Download-Options noopen
		X-DNS-Prefetch-Control off
		-Server
		-X-Powered-By
	}

	encode gzip zstd
}
# To add a new tenant: add "{slug}.natra.site" to the site address list below
# When Cloudflare proxy is enabled, switch to Origin CA cert (see docs)
ivf-dong-do.natra.site {
	# Health checks
	handle /health/* {
		reverse_proxy api:8080
	}

	# API requests
	handle /api/* {
		request_body {
			max_size 10MB
		}
		reverse_proxy api:8080 {
			health_uri      /health/live
			health_interval 15s
			health_timeout  5s
			fail_duration   30s
			lb_policy       round_robin
			lb_retries      2
		}
	}

	# SignalR hubs
	handle /hubs/* {
		reverse_proxy api:8080 {
			health_uri      /health/live
			health_interval 15s
			health_timeout  5s
			fail_duration   30s
			lb_policy       ip_hash
			header_up Connection {http.request.header.Connection}
			header_up Upgrade    {http.request.header.Upgrade}
		}
	}

	# Everything else -> Angular frontend
	handle {
		reverse_proxy frontend:80 {
			health_uri      /
			health_interval 30s
			health_timeout  5s
			fail_duration   30s
		}
	}

	# Security headers
	header {
		X-Content-Type-Options nosniff
		X-Frame-Options DENY
		X-XSS-Protection "0"
		Referrer-Policy no-referrer
		Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
		Content-Security-Policy "default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' data: blob:; font-src 'self' data: https://fonts.gstatic.com; connect-src 'self' wss: ws: https://api.ipify.org; frame-src 'self' blob:; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'self' blob:; upgrade-insecure-requests"
		Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=(), accelerometer=(), gyroscope=(), magnetometer=(), autoplay=(), display-capture=(), document-domain=(), fullscreen=(self), publickey-credentials-get=(self)"
		Cross-Origin-Embedder-Policy unsafe-none
		Cross-Origin-Opener-Policy same-origin
		Cross-Origin-Resource-Policy same-origin
		X-Permitted-Cross-Domain-Policies none
		X-Download-Options noopen
		X-DNS-Prefetch-Control off
		-Server
		-X-Powered-By
	}

	encode gzip zstd
}