matrix-docker-ansible-deploy/examples/caddy2/Caddyfile

(cors) {
	@cors_preflight method OPTIONS

	handle @cors_preflight {
		header Access-Control-Allow-Origin "{args.0}"
		header Access-Control-Allow-Methods "HEAD, GET, POST, PUT, PATCH, DELETE"
		header Access-Control-Allow-Headers "Content-Type, Authorization"
		header Access-Control-Max-Age "3600"
	}
}


matrix.DOMAIN.tld {

  # creates letsencrypt certificate
  # tls your@email.com

  @identity {
        path /_matrix/identity/*
  }

  @noidentity {
        not path /_matrix/identity/*
  }

  @search {
        path /_matrix/client/r0/user_directory/search/*
  }

  @nosearch {
        not path /_matrix/client/r0/user_directory/search/*
  }

  @static {
        path /matrix/static-files/*
  }

  @nostatic {
        not path /matrix/static-files/*
  }

  @wellknown {
        path /.well-known/matrix/*
  }

  header {
        # Enable HTTP Strict Transport Security (HSTS) to force clients to always connect via HTTPS
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        # Enable cross-site filter (XSS) and tell browser to block detected attacks
        X-XSS-Protection "1; mode=block"
        # Prevent some browsers from MIME-sniffing a response away from the declared Content-Type
        X-Content-Type-Options "nosniff"
        # Disallow the site to be rendered within a frame (clickjacking protection)
        X-Frame-Options "DENY"
        # X-Robots-Tag
        X-Robots-Tag "noindex, noarchive, nofollow"
  }

  # Cache
  header @static {
        # Cache
    Cache-Control "public, max-age=31536000"
    defer
  }

  # identity
  handle @identity {
        reverse_proxy localhost:8090  {
               header_up X-Forwarded-Port {http.request.port}
               header_up X-Forwarded-Proto {http.request.scheme}
               header_up X-Forwarded-TlsProto {tls_protocol}
               header_up X-Forwarded-TlsCipher {tls_cipher}
               header_up X-Forwarded-HttpsProto {proto}
        }
  }

  # search
  handle @search {
        reverse_proxy localhost:8090   {
               header_up X-Forwarded-Port {http.request.port}
               header_up X-Forwarded-Proto {http.request.scheme}
               header_up X-Forwarded-TlsProto {tls_protocol}
               header_up X-Forwarded-TlsCipher {tls_cipher}
               header_up X-Forwarded-HttpsProto {proto}
        }
  }

  handle @wellknown {
        encode zstd gzip
        root * /matrix/static-files
	header Cache-Control max-age=14400
        header Content-Type application/json
        header Access-Control-Allow-Origin *
        file_server
  }
  
  # If you have other well-knowns already handled by your base domain, you can replace the above block by this one, along with the replacement suggested in the base domain
  #handle @wellknown {
  #  # .well-known is handled by base domain
  #  reverse_proxy https://DOMAIN.tld {
  #  header_up Host {http.reverse_proxy.upstream.hostport}
  #}

  handle {
        encode zstd gzip

        reverse_proxy localhost:8008  {
               header_up X-Forwarded-Port {http.request.port}
               header_up X-Forwarded-Proto {http.request.scheme}
               header_up X-Forwarded-TlsProto {tls_protocol}
               header_up X-Forwarded-TlsCipher {tls_cipher}
               header_up X-Forwarded-HttpsProto {proto}
        }
  }
}

matrix.DOMAIN.tld:8448 {
    handle {
        encode zstd gzip

        reverse_proxy 127.0.0.1:8048 {
               header_up X-Forwarded-Port {http.request.port}
               header_up X-Forwarded-Proto {http.request.scheme}
               header_up X-Forwarded-TlsProto {tls_protocol}
               header_up X-Forwarded-TlsCipher {tls_cipher}
               header_up X-Forwarded-HttpsProto {proto}
        }
    }
}

element.DOMAIN.tld {

      # creates letsencrypt certificate
      # tls your@email.com

      import cors https://*.DOMAIN.tld

      header {
                # Enable HTTP Strict Transport Security (HSTS) to force clients to always connect via HTTPS
                Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
                # Enable cross-site filter (XSS) and tell browser to block detected attacks
                X-XSS-Protection "1; mode=block"
                # Prevent some browsers from MIME-sniffing a response away from the declared Content-Type
                X-Content-Type-Options "nosniff"
                # Disallow the site to be rendered within a frame (clickjacking protection)
                X-Frame-Options "DENY"
                # If using integrations that add frames to Element, such as Dimension and its integrations running on the same domain, it can be a good idea to limit sources allowed to be rendered
                # Content-Security-Policy frame-src https://*.DOMAIN.tld
                # X-Robots-Tag
                X-Robots-Tag "noindex, noarchive, nofollow"
        }

        handle {
              encode zstd gzip

              reverse_proxy localhost:8765 {
                     header_up X-Forwarded-Port {http.request.port}
                     header_up X-Forwarded-Proto {http.request.scheme}
                     header_up X-Forwarded-TlsProto {tls_protocol}
                     header_up X-Forwarded-TlsCipher {tls_cipher}
                     header_up X-Forwarded-HttpsProto {proto}
        }
}

#dimension.DOMAIN.tld {
#
#      # creates letsencrypt certificate
#      # tls your@email.com
#
#      import cors https://*.DOMAIN.tld
#
#      header {
#          # Enable HTTP Strict Transport Security (HSTS) to force clients to always connect via HTTPS
#          Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
#          # Enable cross-site filter (XSS) and tell browser to block detected attacks
#          X-XSS-Protection "1; mode=block"
#          # Prevent some browsers from MIME-sniffing a response away from the declared Content-Type
#          X-Content-Type-Options "nosniff"
#          # Only allow same base domain to render this website in a frame; Can be removed if the client (Element for example) is hosted on another domain (clickjacking protection)
#          Content-Security-Policy frame-ancestors https://*.DOMAIN.tld
#          # X-Robots-Tag
#          X-Robots-Tag "noindex, noarchive, nofollow"
#    }
#
#      handle {
#          encode zstd gzip
#
#          reverse_proxy localhost:8184  {
#                  header_up X-Forwarded-Port {http.request.port}
#                  header_up X-Forwarded-Proto {http.request.scheme}
#                  header_up X-Forwarded-TlsProto {tls_protocol}
#                  header_up X-Forwarded-TlsCipher {tls_cipher}
#                  header_up X-Forwarded-HttpsProto {proto}
#          }
#    }
#}


#jitsi.DOMAIN.tld {
#
#  creates letsencrypt certificate
#  tls your@email.com
#
#  import cors https://*.DOMAIN.tld
#
#  header {
#        # Enable HTTP Strict Transport Security (HSTS) to force clients to always connect via HTTPS
#        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
#
#        # Enable cross-site filter (XSS) and tell browser to block detected attacks
#        X-XSS-Protection "1; mode=block"
#
#        # Prevent some browsers from MIME-sniffing a response away from the declared Content-Type
#        X-Content-Type-Options "nosniff"

#        # Only allow same base domain to render this website in a frame; Can be removed if the client (Element for example) is hosted on another domain
#        Content-Security-Policy frame-ancestors https://*.DOMAIN.tld
#
#        # Disable some features
#        Feature-Policy "accelerometer 'none';ambient-light-sensor 'none'; autoplay 'none';camera 'none';encrypted-media 'none';focus-without-user-activation 'none'; geolocation 'none';gyroscope #'none';magnetometer 'none';microphone 'none';midi 'none';payment 'none';picture-in-picture 'none'; speaker 'none';sync-xhr 'none';usb 'none';vr 'none'"
#
#        # Referer
#        Referrer-Policy "no-referrer"
#
#        # X-Robots-Tag
#        X-Robots-Tag "none"
#
#        # Remove Server header
#        -Server
#  }
#
#  handle {
#        encode zstd gzip
#
#        reverse_proxy 127.0.0.1:13080 {
#               header_up X-Forwarded-Port {http.request.port}
#               header_up X-Forwarded-Proto {http.request.scheme}
#               header_up X-Forwarded-TlsProto {tls_protocol}
#               header_up X-Forwarded-TlsCipher {tls_cipher}
#               header_up X-Forwarded-HttpsProto {proto}
#        }
#  }
#}
#DOMAIN.com {
# Uncomment this if you are following "(Option 3): Setting up reverse-proxying of the well-known files from the base domain's server to the Matrix server" of https://github.com/spantaleev/matrix-docker-ansible-deploy/blob/master/docs/configuring-well-known.md#option-3-setting-up-reverse-proxying-of-the-well-known-files-from-the-base-domains-server-to-the-matrix-server
#    @wellknown {
#        path /.well-known/matrix/*
#    }
#
#    handle @wellknown {
#        reverse_proxy https://matrix.DOMAIN.com {
#            header_up Host {http.reverse_proxy.upstream.hostport}
#        }
#    }
#    # If you have other well-knowns already handled by your base domain, you can replace the above block by this one, along with the replacement suggested in the matrix subdomain
#      # handle /.well-known/* {
#	#	encode zstd gzip
#	#	header Cache-Control max-age=14400
#	#	header Content-Type application/json
#	#	header Access-Control-Allow-Origin *
#	#}
#
#    # Configration for the base domain goes here
#   # handle {
#   #    header -Server
#   #     encode zstd gzip
#   #    reverse_proxy localhost:4020
#   # }
#}