# /etc/caddy/Caddyfile
{
	# Zero logs: no site has a `log` directive, so there is no access log; handler
	# errors are dropped too, because Caddy logs them with the client IP.
	log default {
		exclude http.log.error
	}
}

www.init.surf {
	redir https://init.surf{uri} permanent
}

init.surf {
	root * /var/www/init
	file_server

	header {
		Strict-Transport-Security "max-age=31536000; includeSubDomains"
		X-Content-Type-Options nosniff
		Content-Security-Policy "default-src 'none'; style-src 'self'; img-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'"
		Referrer-Policy no-referrer
		Cache-Control no-cache
	}
	header /init.exe {
		Content-Type application/octet-stream
		Content-Disposition attachment
	}

	# /c/<id>: web view of public channels (SPEC §5.17), not implemented yet. When it is,
	# uncomment and add http.handlers.reverse_proxy to the `exclude` list above:
	# handle /c/* {
	# 	reverse_proxy 127.0.0.1:8080
	# }
}
