From f03a3c03b85ffc07aba02222ac23de9e38206956 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=2E=20Nam=C3=A8che?= <sebastien@itik.fr>
Date: Wed, 11 Mar 2026 15:40:38 +0300
Subject: [PATCH] caddy: add site.header and path.strip_prefix

---
 seb4itik/byow/roles/caddy/defaults/main.yml   | 13 +++++++------
 seb4itik/byow/roles/caddy/templates/Caddyfile |  4 +++-
 seb4itik/byow/roles/caddy/vars/main.yml       |  2 ++
 3 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/seb4itik/byow/roles/caddy/defaults/main.yml b/seb4itik/byow/roles/caddy/defaults/main.yml
index 77ad631..1fe1fba 100644
--- a/seb4itik/byow/roles/caddy/defaults/main.yml
+++ b/seb4itik/byow/roles/caddy/defaults/main.yml
@@ -77,12 +77,13 @@ caddy_crs_plugins:
 
 # Sites
 caddy_sites: []
-# - id: ""            # Mandatory: short id for the site (for site specific directories and files)
-#   name: ""          # Mandatory: canonical domain name
-#   paths:            # Mandatory: targets for the reverse proxy
-#     - path: ""      # Optionnal: path of the request, default "*"
-#       addrs:        # Mandatory: upstreams
-#         - ""        # Mandatory: URL of the upstream, minimum 1 required
+# - id: ""                   # Mandatory: short id for the site (for site specific directories and files)
+#   name: ""                 # Mandatory: canonical domain name
+#   paths:                   # Mandatory: targets for the reverse proxy
+#     - path: "*"            # Optionnal: path of the request, default "*"
+#       strip_prefix: false  # Optionnal: default "false"
+#       addrs:               # Mandatory: upstreams
+#         - ""               # Mandatory: URL of the upstream, minimum 1 required
 
 
 # For overriding default global parameters. Will be merged with
diff --git a/seb4itik/byow/roles/caddy/templates/Caddyfile b/seb4itik/byow/roles/caddy/templates/Caddyfile
index 60d3fca..78885a6 100644
--- a/seb4itik/byow/roles/caddy/templates/Caddyfile
+++ b/seb4itik/byow/roles/caddy/templates/Caddyfile
@@ -118,7 +118,7 @@
   encode gzip zstd
 
 {% for path in site.paths %}
-  handle {{ path.path | default('*') }} {
+  handle{% if path.strip_prefix | default(false) %}_path{% endif %} {{ path.path | default('*') }} {
     reverse_proxy {
       to {{ path.addrs | join(' ') }}
       header_up X-Real-IP {remote}
@@ -273,6 +273,7 @@
   }
 {% endif %}
 
+{% if site.header | default(caddy_sites_defaults.header) %}
   header {
     Content-Security-Policy      "{{ caddy_sites_defaults.header_content_security_policy | combine(site.header_content_security_policy | default({})) | dict2str(sep1=' ', sep2='; ', sep3=';') }}"
     Cross-Origin-Embedder-Policy "{{ site.header_cross_origin_embedder_policy | default(caddy_sites_defaults.header_cross_origin_embedder_policy) }}"
@@ -294,6 +295,7 @@
     {{ header.name }}            "{{ header.value }}"
 {% endfor %}
   }
+{% endif %}
 
   handle_errors 403 {
     header X-Blocked "true"
diff --git a/seb4itik/byow/roles/caddy/vars/main.yml b/seb4itik/byow/roles/caddy/vars/main.yml
index b546e34..6c6e86c 100644
--- a/seb4itik/byow/roles/caddy/vars/main.yml
+++ b/seb4itik/byow/roles/caddy/vars/main.yml
@@ -90,6 +90,8 @@ caddy_global_sites_defaults:
     - "Content-Length"
     - "Content-Range"
 
+  header: true
+
   # Security headers
   header_content_security_policy: