From 0469b932745d6ff59523ce3ef69bb86c7512fc9f Mon Sep 17 00:00:00 2001
From: denis0001-dev <denis0001.dev@ya.ru>
Date: Wed, 31 Dec 2025 21:01:57 +0300
Subject: [PATCH] Add Caddy to deployment

---
 deployment/caddy/Caddyfile    | 80 +++++++++++++++++++++++++++++++++++
 deployment/caddy/Dockerfile   | 14 ++++++
 deployment/docker-compose.yml | 17 ++++++++
 deployment/fromchat.service   |  2 +-
 4 files changed, 112 insertions(+), 1 deletion(-)
 create mode 100644 deployment/caddy/Caddyfile
 create mode 100644 deployment/caddy/Dockerfile

diff --git a/deployment/caddy/Caddyfile b/deployment/caddy/Caddyfile
new file mode 100644
index 0000000..25631fb
--- /dev/null
+++ b/deployment/caddy/Caddyfile
@@ -0,0 +1,80 @@
+fromchat.ru {
+	reverse_proxy 172.18.0.1:8301 host.docker.internal:8301 172.17.0.1:8301 {
+		lb_policy first
+        header_up X-Real-IP {remote_host}
+	}
+
+	# Security headers
+	header {
+		X-XSS-Protection "1; mode=block" # Prevent XSS attacks
+		X-Content-Type-Options "nosniff" # Prevent MIME type sniffing
+		X-Frame-Options "DENY" # Prevent clickjacking
+		Referrer-Policy "strict-origin-when-cross-origin"
+		Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https: blob:; font-src 'self' data:; connect-src 'self'; frame-ancestors 'none';"
+		Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+		Permissions-Policy "geolocation=(), microphone=(self), camera=(self)"
+	}
+
+	rate_limit {
+		zone global {
+			key {remote_ip}
+			window 1m
+			burst 20
+			events 500
+		}
+	}
+
+	handle_errors {
+		@errors {
+			expression {err.status_code} >= 400
+		}
+
+		handle @errors {
+			rewrite * /{err.status_code}
+			reverse_proxy https://http.cat {
+				header_up Host {upstream_hostport}
+				replace_status {err.status_code}
+			}
+		}
+	}
+}
+
+beta.fromchat.ru {
+    reverse_proxy 95.165.0.162:8301 {
+        header_up X-Real-IP {remote_host}
+    }
+
+	# Security headers
+	header {
+		X-XSS-Protection "1; mode=block" # Prevent XSS attacks
+		X-Content-Type-Options "nosniff" # Prevent MIME type sniffing
+		X-Frame-Options "DENY" # Prevent clickjacking
+		Referrer-Policy "strict-origin-when-cross-origin"
+		Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https: blob:; font-src 'self' data:; connect-src 'self'; frame-ancestors 'none';"
+		Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+		Permissions-Policy "geolocation=(), microphone=(self), camera=(self)"
+	}
+
+	rate_limit {
+		zone global {
+			key {remote_ip}
+			window 1m
+			burst 20
+			events 1000
+		}
+	}
+
+	handle_errors {
+		@errors {
+			expression {err.status_code} >= 400
+		}
+
+		handle @errors {
+			rewrite * /{err.status_code}
+			reverse_proxy https://http.cat {
+				header_up Host {upstream_hostport}
+				replace_status {err.status_code}
+			}
+		}
+	}
+}
diff --git a/deployment/caddy/Dockerfile b/deployment/caddy/Dockerfile
new file mode 100644
index 0000000..d28722a
--- /dev/null
+++ b/deployment/caddy/Dockerfile
@@ -0,0 +1,14 @@
+#
+# Custom Caddy built with:
+# - Rate limit plugin
+#
+
+FROM caddy:2-builder AS builder
+RUN xcaddy build \
+      --with github.com/mholt/caddy-ratelimit
+RUN curl -o /etc/ssl/cloudflare-origin.crt https://developers.cloudflare.com/ssl/static/origin_ca_rsa_root.pem
+
+FROM caddy:2
+
+COPY --from=builder /usr/bin/caddy /usr/bin/caddy
+COPY Caddyfile /etc/caddy/Caddyfile
\ No newline at end of file
diff --git a/deployment/docker-compose.yml b/deployment/docker-compose.yml
index c26d5e8..9c145aa 100644
--- a/deployment/docker-compose.yml
+++ b/deployment/docker-compose.yml
@@ -42,6 +42,23 @@ services:
         - action: rebuild
           path: package.json
 
+  caddy:
+    build:
+      context: ./caddy
+      dockerfile: Dockerfile
+    restart: unless-stopped
+    profiles: ["prod"]
+    ports:
+      - "80:80"
+      - "443:443"
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    volumes:
+      - certs:/root/site/certs
+    environment:
+      XDG_DATA_HOME: /root/site/certs
+      XDG_CONFIG_HOME: /root/site/certs
+
 volumes:
   data:
     name: fromchat-data
diff --git a/deployment/fromchat.service b/deployment/fromchat.service
index 7524770..77fd4d3 100644
--- a/deployment/fromchat.service
+++ b/deployment/fromchat.service
@@ -10,7 +10,7 @@ StartLimitBurst=3
 Type=simple
 User=root
 Group=root
-ExecStart=/bin/docker compose up
+ExecStart=/bin/docker compose up --profile prod
 ExecStop=/bin/docker compose down
 WorkingDirectory=/home/denis0001-dev/actions-runner/_work/FromChat/FromChat/deployment
 Restart=always