From d7b6e468d722941c4260756f10c16d1a640f6b78 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?S=2E=20Nam=C3=A8che?= Date: Mon, 2 Feb 2026 22:09:18 +0300 Subject: [PATCH] caddy: CORS --- seb4itik/byow/roles/caddy/templates/Caddyfile | 131 ++++++++++++------ seb4itik/byow/roles/caddy/vars/main.yml | 34 +++-- 2 files changed, 115 insertions(+), 50 deletions(-) diff --git a/seb4itik/byow/roles/caddy/templates/Caddyfile b/seb4itik/byow/roles/caddy/templates/Caddyfile index 8102edd..674224a 100644 --- a/seb4itik/byow/roles/caddy/templates/Caddyfile +++ b/seb4itik/byow/roles/caddy/templates/Caddyfile @@ -1,7 +1,9 @@ { http_port {{ caddy_http_port }} https_port {{ caddy_https_port }} +{% if caddy_default_bind != "" %} default_bind {{ caddy_default_bind }} +{% endif %} order geoip2_vars first order coraza_waf first admin off @@ -44,6 +46,43 @@ } } +# 0=origin, 1=methods, 2=headers, 3=allow credentials, 4=max age, 5=vary, 6=expose headers +(cors) { + @match-cors-preflight-{args.0} { + header Origin {args.0} + method OPTIONS + } + header @match-cors-preflight-{args.0} { + Access-Control-Allow-Origin "{args.0}" + Access-Control-Allow-Methods "{args.1}" + Access-Control-Allow-Headers "{args.2}" + Access-Control-Allow-Credentials "{args.3}" + Access-Control-Max-Age "{args.4}" + Vary "{args.5}" + } + handle @match-cors-preflight-{args.0} { + respond "" 204 + } + + @match-cors-request-{args.0} { + header Origin {args.0} + not method OPTIONS + } + header @match-cors-request-{args.0} { + >Access-Control-Allow-Origin "{args.0}" + >Access-Control-Allow-Credentials "{args.3}" + >Vary "{args.5}" + >Access-Control-Expose-Headers "{args.6}" + } +} + +(cors-deny) { + @cors-preflight-deny method OPTIONS + handle @cors-preflight-deny { + respond "" 403 + } +} + {% for site in caddy_sites %} {% if (site.site_redirect_from_aliases | default(caddy_sites_defaults.site_redirect_from_aliases)) and (site.site_aliases | default([]) | length) > 0 %} @@ -103,33 +142,33 @@ respond @geofilter "Access Denied" 403 {% if site.geoip_debug | default(caddy_sites_defaults.geoip_debug) %} - header geoip-is_anonymous "{geoip2.is_anonymous}" - header geoip-is_anonymous_vpn "{geoip2.is_anonymous_vpn}" - header geoip-is_hosting_provider "{geoip2.is_hosting_provider}" - header geoip-is_public_proxy "{geoip2.is_public_proxy}" - header geoip-is_residential_proxy "{geoip2.is_residential_proxy}" - header geoip-is_tor_exit_node "{geoip2.is_tor_exit_node}" - header geoip-connection_type "{geoip2.connection_type}" - header geoip-domain "{geoip2.domain}" - header geoip-country_code "{geoip2.country_code}" - header geoip-country_confidence "{geoip2.country_confidence}" - header geoip-country_eu "{geoip2.country_eu}" - header geoip-country_geoname_id "{geoip2.country_geoname_id}" - header geoip-country_name "{geoip2.country_name}" - header geoip-continent_code "{geoip2.continent_code}" - header geoip-continent_geoname_id "{geoip2.continent_geoname_id}" - header geoip-continent_name "{geoip2.continent_name}" - header geoip-city_confidence "{geoip2.city_confidence}" - header geoip-city_geoname_id "{geoip2.city_geoname_id}" - header geoip-city_name "{geoip2.city_name}" - header geoip-location_time_zone "{geoip2.location_time_zone}" - header geoip-autonomous_system_number "{geoip2.autonomous_system_number}" - header geoip-autonomous_system_organization "{geoip2.autonomous_system_organization}" - header geoip-isp "{geoip2.isp}" - header geoip-mobile_country_code "{geoip2.mobile_country_code}" - header geoip-mobile_network_code "{geoip2.mobile_network_code}" - header geoip-organization "{geoip2.organization}" - header geoip-ip_address "{geoip2.ip_address}" + header x-geoip-is-anonymous "{geoip2.is_anonymous}" + header x-geoip-is-anonymous-vpn "{geoip2.is_anonymous_vpn}" + header x-geoip-is-hosting-provider "{geoip2.is_hosting_provider}" + header x-geoip-is-public-proxy "{geoip2.is_public_proxy}" + header x-geoip-is-residential-proxy "{geoip2.is_residential_proxy}" + header x-geoip-is-tor-exit-node "{geoip2.is_tor_exit_node}" + header x-geoip-connection-type "{geoip2.connection_type}" + header x-geoip-domain "{geoip2.domain}" + header x-geoip-country-code "{geoip2.country_code}" +# header x-geoip-country-confidence "{geoip2.country_confidence}" + header x-geoip-country-eu "{geoip2.country_eu}" + header x-geoip-country-geoname-id "{geoip2.country_geoname_id}" + header x-geoip-country-name "{geoip2.country_name}" + header x-geoip-continent-code "{geoip2.continent_code}" + header x-geoip-continent-geoname-id "{geoip2.continent_geoname_id}" + header x-geoip-continent-name "{geoip2.continent_name}" +# header x-geoip-city-confidence "{geoip2.city_confidence}" + header x-geoip-city-geoname-id "{geoip2.city_geoname_id}" + header x-geoip-city-name "{geoip2.city_name}" + header x-geoip-location-time-zone "{geoip2.location_time_zone}" + header x-geoip-autonomous-system-number "{geoip2.autonomous_system_number}" + header x-geoip-autonomous-system-organization "{geoip2.autonomous_system_organization}" + header x-geoip-isp "{geoip2.isp}" + header x-geoip-mobile-country-code "{geoip2.mobile_country_code}" + header x-geoip-mobile-network-code "{geoip2.mobile_network_code}" + header x-geoip-organization "{geoip2.organization}" + header x-geoip-ip-address "{geoip2.ip_address}" {% endif %} {% endif %} @@ -139,18 +178,6 @@ {% endfor %} } -{% if site.bot_barrier | default(caddy_sites_defaults.bot_barrier) %} - bot_barrier @not_whitelisted { - secret {{ site.bot_barrier_secret | default(caddy_sites_defaults.bot_barrier_secret) | mandatory }} - complexity {{ site.bot_barrier_complexity | default(caddy_sites_defaults.bot_barrier_complexity) }} - valid_for {{ site.bot_barrier_valid_for | default(caddy_sites_defaults.bot_barrier_valid_for) }} - seed_cookie_name __chall_{{ site.id }}_seed - solution_cookie_name __chall_{{ site.id }}_solution - mac_cookie_name __chall_{{ site.id }}_mac - template {{ caddy_config_dir }}/bot_barrier_template.html - } -{% endif %} - {% if site.rate_limit | default(caddy_sites_defaults.rate_limit) %} rate_limit @not_whitelisted { # distributed @@ -183,11 +210,31 @@ } {% endif %} +{% if site.cors | default(caddy_sites_defaults.cors) %} +{% for origin in site.cors_allow_origins | mandatory %} + import cors {{ origin }} "{{ site.cors_allow_methods | default(caddy_sites_defaults.cors_allow_methods) | join(', ') }}" "{{ site.cors_allow_headers | default(caddy_sites_defaults.cors_allow_headers) | join(', ') }}" "{{ site.cors_allow_credentials | default(caddy_sites_defaults.cors_allow_credentials) | ternary('true', 'false') }}" "{{ site.cors_max_age | default(caddy_sites_defaults.cors_max_age) }}" "{{ site.cors_vary | default(caddy_sites_defaults.cors_vary) | join(', ') }}" "{{ site.cors_expose_headers | default(caddy_sites_defaults.cors_expose_headers) | join(', ') }}" +{% endfor %} + import cors-deny +{% endif %} + +{% if site.bot_barrier | default(caddy_sites_defaults.bot_barrier) %} + bot_barrier @not_whitelisted { + secret {{ site.bot_barrier_secret | default(caddy_sites_defaults.bot_barrier_secret) | mandatory }} + complexity {{ site.bot_barrier_complexity | default(caddy_sites_defaults.bot_barrier_complexity) }} + valid_for {{ site.bot_barrier_valid_for | default(caddy_sites_defaults.bot_barrier_valid_for) }} + seed_cookie_name __chall_{{ site.id }}_seed + solution_cookie_name __chall_{{ site.id }}_solution + mac_cookie_name __chall_{{ site.id }}_mac + template {{ caddy_config_dir }}/bot_barrier_template.html + } +{% endif %} + header { Content-Security-Policy "{{ caddy_sites_defaults.header_content_security_policy | combine(site.header_content_security_policy | default({})) | dict2str(sep1=' ', sep2='; ', sep3=';') }}" - Cross-Origin-Embedder-Policy "{{ site.header_cross_origin_embedder_policy | default(caddy_sites_defaults.header_cross_origin_embedder_policy) }}" - Cross-Origin-Opener-Policy "{{ site.header_cross_origin_opener_policy | default(caddy_sites_defaults.header_cross_origin_opener_policy) }}" - Cross-Origin-Resource-Policy "{{ site.header_cross_origin_resource_policy | default(caddy_sites_defaults.header_cross_origin_resource_policy) }}" +# FIXME +# Cross-Origin-Embedder-Policy "{{ site.header_cross_origin_embedder_policy | default(caddy_sites_defaults.header_cross_origin_embedder_policy) }}" +# Cross-Origin-Opener-Policy "{{ site.header_cross_origin_opener_policy | default(caddy_sites_defaults.header_cross_origin_opener_policy) }}" +# Cross-Origin-Resource-Policy "{{ site.header_cross_origin_resource_policy | default(caddy_sites_defaults.header_cross_origin_resource_policy) }}" Feature-Policy "{{ caddy_sites_defaults.header_feature_policy | combine(site.header_feature_policy | default({})) | dict2str(sep1=' ', sep2='; ', sep3=';') }}" Permissions-Policy "{{ caddy_sites_defaults.header_permissions_policy | combine(site.header_permissions_policy | default({})) | dict2str(sep2=', ') }}" Referrer-Policy "{{ site.header_referrer_policy | default(caddy_sites_defaults.header_referrer_policy) }}" diff --git a/seb4itik/byow/roles/caddy/vars/main.yml b/seb4itik/byow/roles/caddy/vars/main.yml index 0864291..d6031d7 100644 --- a/seb4itik/byow/roles/caddy/vars/main.yml +++ b/seb4itik/byow/roles/caddy/vars/main.yml @@ -19,6 +19,11 @@ caddy_global_sites_defaults: # query [key] # header [field] # cookie [ []] + + + # Filters + filter_blacklist: [] # Superseeds filter_whitelist + filter_whitelist: ["127.0.0.1"] # Custom TLS certificate @@ -27,10 +32,27 @@ caddy_global_sites_defaults: custom_cert_key_file: "" - # Filters - filter_blacklist: [] # Superseeds filter_whitelist - filter_whitelist: ["127.0.0.1"] - + # CORS - Cross Origin Resource Sharing + cors: false + cors_allow_origins: null # Mandatory + cors_allow_methods: + - "GET" + - "HEAD" + - "POST" + - "OPTIONS" + cors_allow_headers: + - "Cache-Control" + - "Content-Type" + - "If-Modified-Since" + - "Range" + - "User-Agent" + cors_max_age: 3600 + cors_allow_credentials: false + cors_vary: + - "Origin" + cors_expose_headers: + - "Content-Length" + - "Content-Range" # Security headers header_content_security_policy: @@ -391,7 +413,3 @@ caddy_global_sites_defaults: geoip: false geoip_debug: false geoip_filter_expression: '{geoip2.country_code} == "UNK"' -# geoip_deny_countries: [] # ISO country codes (2 letters), "UNK" for unknown country -# geoip_allow_countries: [] # ISO country codes (2 letters), "UNK" for unknown country -# geopip_deny_asn: [] -# geopip_allow_asn: []