first commit

deploy/caddy/Caddyfile

@@ -0,0 +1,70 @@
+{
+	admin off
+	email {$ACME_EMAIL}
+}
+
+malenia.space {
+	encode zstd gzip
+
+	log {
+		output stdout
+		format json
+	}
+
+	header {
+		Strict-Transport-Security "max-age=31536000; includeSubDomains"
+		X-Content-Type-Options "nosniff"
+		X-Frame-Options "DENY"
+		Referrer-Policy "strict-origin-when-cross-origin"
+		Permissions-Policy "camera=(), geolocation=(), microphone=()"
+	}
+
+	@api path /api/*
+	route @api {
+		rate_limit {
+			zone auth {
+				match {
+					path /api/auth/login /api/auth/signup /api/auth/refresh
+				}
+				key {remote_host}
+				events 10
+				window 1m
+				ipv6_prefix 64
+			}
+			zone checkout {
+				match {
+					path /api/orders/checkout
+				}
+				key {remote_host}
+				events 10
+				window 10m
+				ipv6_prefix 64
+			}
+			zone payment_callback {
+				match {
+					path /api/payments/pally/result
+				}
+				key {remote_host}
+				events 60
+				window 1m
+				ipv6_prefix 64
+			}
+			zone api {
+				match {
+					not path /api/health/
+				}
+				key {remote_host}
+				events 120
+				window 1m
+				ipv6_prefix 64
+			}
+		}
+
+		uri strip_prefix /api
+		reverse_proxy backend:8000
+	}
+
+	root * /srv
+	try_files {path} /index.html
+	file_server
+}

deploy/caddy/Caddyfile.local

@@ -0,0 +1,57 @@
+{
+	admin off
+}
+
+:80 {
+	encode zstd gzip
+
+	log {
+		output stdout
+		format json
+	}
+
+	@api path /api/*
+	route @api {
+		rate_limit {
+			zone auth {
+				match {
+					path /api/auth/login /api/auth/signup /api/auth/refresh
+				}
+				key {remote_host}
+				events 10
+				window 1m
+			}
+			zone checkout {
+				match {
+					path /api/orders/checkout
+				}
+				key {remote_host}
+				events 10
+				window 10m
+			}
+			zone payment_callback {
+				match {
+					path /api/payments/pally/result
+				}
+				key {remote_host}
+				events 60
+				window 1m
+			}
+			zone api {
+				match {
+					not path /api/health/
+				}
+				key {remote_host}
+				events 120
+				window 1m
+			}
+		}
+
+		uri strip_prefix /api
+		reverse_proxy backend:8000
+	}
+
+	root * /srv
+	try_files {path} /index.html
+	file_server
+}

deploy/caddy/Dockerfile

@@ -0,0 +1,25 @@
+ARG CADDY_VERSION=2.10.2
+ARG CADDYFILE=deploy/caddy/Caddyfile
+
+FROM node:22-alpine AS frontend
+
+WORKDIR /app
+
+COPY frontend/package.json frontend/package-lock.json ./
+RUN npm ci
+
+COPY frontend/ ./
+RUN npm run build
+
+FROM caddy:${CADDY_VERSION}-builder AS builder
+
+RUN xcaddy build \
+    --with github.com/mholt/caddy-ratelimit@5625512f24f6f59d6f64fb3aafe5eecff0b286db
+
+FROM caddy:${CADDY_VERSION}-alpine
+
+ARG CADDYFILE
+
+COPY --from=builder /usr/bin/caddy /usr/bin/caddy
+COPY ${CADDYFILE} /etc/caddy/Caddyfile
+COPY --from=frontend /app/dist/ /srv/