first commit

deploy/caddy/Caddyfile

@@ -0,0 +1,70 @@
+{
+	admin off
+	email {$ACME_EMAIL}
+}
+
+malenia.space {
+	encode zstd gzip
+
+	log {
+		output stdout
+		format json
+	}
+
+	header {
+		Strict-Transport-Security "max-age=31536000; includeSubDomains"
+		X-Content-Type-Options "nosniff"
+		X-Frame-Options "DENY"
+		Referrer-Policy "strict-origin-when-cross-origin"
+		Permissions-Policy "camera=(), geolocation=(), microphone=()"
+	}
+
+	@api path /api/*
+	route @api {
+		rate_limit {
+			zone auth {
+				match {
+					path /api/auth/login /api/auth/signup /api/auth/refresh
+				}
+				key {remote_host}
+				events 10
+				window 1m
+				ipv6_prefix 64
+			}
+			zone checkout {
+				match {
+					path /api/orders/checkout
+				}
+				key {remote_host}
+				events 10
+				window 10m
+				ipv6_prefix 64
+			}
+			zone payment_callback {
+				match {
+					path /api/payments/pally/result
+				}
+				key {remote_host}
+				events 60
+				window 1m
+				ipv6_prefix 64
+			}
+			zone api {
+				match {
+					not path /api/health/
+				}
+				key {remote_host}
+				events 120
+				window 1m
+				ipv6_prefix 64
+			}
+		}
+
+		uri strip_prefix /api
+		reverse_proxy backend:8000
+	}
+
+	root * /srv
+	try_files {path} /index.html
+	file_server
+}