# Sites default parameter values
caddy_global_sites_defaults:

  # Site settings
  site_aliases: []
  site_redirect_from_aliases: true

  # Log settings
  # If log_to_file is true, logs will go:
  # - for each site, in: /var/log/<caddy_my_name>/site_<site id>.log
  # - for WAF logs (Coraza), in /var/log/<caddy_my_name>/waf.log
  log_to_file: false
  log_format: "json"

  # Proxy settings
  # See: https://caddyserver.com/docs/caddyfile/directives/reverse_proxy#lb_policy
  proxy_lb_policy: "ip_hash"  # random
                              # random_choose <n>
                              # first
                              # round_robin
                              # weighted_round_robin <weights...>
                              # least_conn
                              # ip_hash
                              # client_ip_hash
                              # uri_hash
                              # query [key]
                              # header [field]
                              # cookie [<name> [<secret>]]

  # Upstreams active checks
  # See: https://caddyserver.com/docs/caddyfile/directives/reverse_proxy#active-health-checks
  proxy_active_checks: false
  proxy_active_checks_uri: "/"
  proxy_active_checks_port: 80
  proxy_active_checks_interval: "30s"
  proxy_active_checks_timeout: "5s"
  proxy_active_checks_method: "GET"
  proxy_active_checks_status: "2xx"
  proxy_active_checks_body: null

  # Upstreams passive checks
  # See: https://caddyserver.com/docs/caddyfile/directives/reverse_proxy#passive-health-checks
  proxy_passive_checks: false
  proxy_passive_checks_fail_duration: "30s"
  proxy_passive_checks_max_fails: 1
  proxy_passive_checks_unhealthy_status: "5xx"
  proxy_passive_checks_unhealthy_latency: "2000ms"
  proxy_passive_checks_unhealthy_request_count: null

  # Filters
  filter_blacklist: []        # Superseeds filter_whitelist
  filter_whitelist: ["127.0.0.1"]

  # Custom TLS certificate
  custom_cert: false
  custom_cert_file: null      # Mandatory if custum_cert is true
  custom_cert_key_file: null  # Mandatory if custum_cert is true

  # CORS - Cross Origin Resource Sharing
  cors: false
  cors_allowed_origins: []    # Minimum 1 required
  cors_allowed_methods:
  # These variables can be used for adding and removing methods from the list:
  # cors_allowed_methods_add: ["XXX"]
  # cors_allowed_methods_del: ["YYY"]
    - "GET"
    - "HEAD"
    - "POST"
    - "OPTIONS"
  cors_allowed_headers:
  # These variables can be used for adding and removing headers from the list:
  # cors_allowed_headers_add: ["Xxx"]
  # cors_allowed_headers_del: ["Yyy"]
    - "Cache-Control"
    - "Content-Type"
    - "If-Modified-Since"
    - "Range"
    - "User-Agent"
  cors_max_age: 3600
  cors_allowed_credentials: false
  cors_vary:
  # These variables can be used for adding and removing headers from the list:
  # cors_vary_add: ["Xxx"]
  # cors_vary_del: ["Yyy"]
    - "Origin"
  cors_exposed_headers:
  # These variables can be used for adding and removing headers from the list:
  # cors_exposed_headers_add: ["Xxx"]
  # cors_exposed_headers_del: ["Yyy"]
    - "Content-Length"
    - "Content-Range"

  header: true

  # Security headers
  header_content_security_policy:

    # https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html#detailed-csp-directives
    # https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy#directives
    ## Fetch directives
    child-src: "'self'"
    connect-src: "'self'"
    font-src: "'self'"
    img-src: "'self'"
    manifest-src: "'self'"
    media-src: "'self'"
    # Deprecated: prefetch-src: "'self'"
    object-src: "'none'"
    script-src: "'none'"
    script-src-attr: "'none'"
    script-src-elem: "'none'"
    style-src: "'self'"
    style-src-attr: "'self'"
    style-src-elem: "'self'"
    default-src: "'self'"
    ## Document directives
    # base-uri
    # plugin-types
    # sandbox
    ## Navigation directives
    form-action: "'self'"
    frame-ancestors: "'self'"
    # https://developer.mozilla.org/fr/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/frame-src
    frame-src: "'self'"
    # https://developer.mozilla.org/fr/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/worker-src
    worker-src: "'self'"
    # https://developer.mozilla.org/fr/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/block-all-mixed-content
    block-all-mixed-content:
    # https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/fenced-frame-src
    fenced-frame-src: "'self'"
    # https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/upgrade-insecure-requests
    upgrade-insecure-requests:

  # https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Embedder-Policy
  header_cross_origin_embedder_policy: "require-corp"

  # https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Opener-Policy
  header_cross_origin_opener_policy: "same-origin"

  # https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Resource-Policy
  header_cross_origin_resource_policy: "same-site"

  # https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy
  header_permissions_policy:
    accelerometer: "()"
    ambient-light-sensor: "()"
    aria-notify: "()"
    attribution-reporting: "()"
    autoplay: "()"
    bluetooth: "()"
    browsing-topics: "()"
    camera: "()"
    captured-surface-control: "()"
    compute-pressure: "()"
    cross-origin-isolated: "()"
    deferred-fetch: "()"
    deferred-fetch-minimal: "()"
    display-capture: "()"
    encrypted-media: "()"
    fullscreen: "()"
    gamepad: "()"
    geolocation: "()"
    gyroscope: "()"
    hid: "()"
    identity-credentials-get: "()"
    idle-detection: "()"
    language-detector: "()"
    local-fonts: "()"
    magnetometer: "()"
    microphone: "()"
    midi: "()"
    on-device-speech-recognition: "()"
    otp-credentials: "()"
    payment: "()"
    picture-in-picture: "()"
    private-state-token-issuance: "()"
    private-state-token-redemption: "()"
    publickey-credentials-create: "()"
    publickey-credentials-get: "()"
    screen-wake-lock: "()"
    serial: "()"
    speaker-selection: "()"
    storage-access: "()"
    translator: "()"
    summarizer: "()"
    usb: "()"
    web-share: "()"
    window-management: "()"
    xr-spatial-tracking: "()"

    # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#floc-federated-learning-of-cohorts
    interest-cohort: "()"

    # ???
    battery: "()"
    document-domain: "()"
    execution-while-not-rendered: "()"
    execution-while-out-of-viewport: "()"
    navigation-override: "()"

  # https://www.geeksforgeeks.org/computer-networks/http-headers-feature-policy/
  header_feature_policy:
    accelerometer: "'none'"
    ambient-light-sensor: "'none'"
    autoplay: "'none'"
    battery: "'none'"
    camera: "'none'"
    display-capture: "'none'"
    document-domain: "'none'"
    encrypted-media: "'none'"
    fullscreen: "'none'"
    geolocation: "'none'"
    gyroscope: "'none'"
    layout-animation: "'none'"
    legacy-image-formats: "'none'"
    magnetometer: "'none'"
    microphone: "'none'"
    midi: "'none'"
    oversized-images: "'none'"
    payment: "'none'"
    picture-in-picture: "'none'"
    publickey-credentials-get: "'none'"
    sync-xhr: "'none'"
    usb: "'none'"
    screen-wake-lock: "'none'"
    xr-spatial-tracking: "'none'"

    # ???
    execution-while-not-rendered: "'none'"
    execution-while-out-of-viewport: "'none'"
    navigation-override: "'none'"
    speaker-selection: "'none'"
    unoptimized-images: "'none'"
    unsized-media: "'none'"
    web-share: "'none'"

  # https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Referrer-Policy
  header_referrer_policy: "strict-origin-when-cross-origin"

  # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.html
  header_strict_transport_security: "max-age=2635200; includeSubDomains"

  # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-content-type-options
  header_x_content_type_options: "nosniff"

  # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-frame-options
  header_x_frame_options: "DENY"

  # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-robots-tag
  header_x_robots_tag: "noindex, nofollow"

  # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#content-type
  header_default_content_type: "text/html; charset=UTF-8"

  # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#set-cookie
  header_cookies_attributes: "SameSite=None; Secure;"

  # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-dns-prefetch-control
  # FIXME

  # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#server
  # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-aspnet-version
  # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-aspnetmvc-version
  # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-powered-by
  header_delete:
    - "Server"
    - "Via"
    - "X-AspNet-Version"
    - "X-AspNetMvc-Version"
    - "X-Powered-By"

  header_add:
    - name: "X-BYOW"
      value: "🍷"

  # caddy-ratelimit
  rate_limit: true
  rate_limit_events: 1000
  rate_limit_window: "1m"

  # steffenbusch/caddy-bot-barrier
  bot_barrier: false
  bot_barrier_secret: null    # Required
  bot_barrier_complexity: 18
  bot_barrier_valid_for: "60m"

  # corazawaf/coraza-caddy
  crs: true
  crs_version: "4.24.1"
  crs_log_only: false
  crs_plugins: []
  crs_exceptions:
    before_request: []
    after_response: []
  crs_paranoia_level: 4
  crs_detection_paranoia_level: null
  crs_enforce_bodyproc_urlencoded: 1
  crs_critical_anomaly_score: 5
  crs_error_anomaly_score: 4
  crs_warning_anomaly_score: 3
  crs_notice_anomaly_score: 2
  crs_inbound_anomaly_score_threshold: 5
  crs_outbound_anomaly_score_threshold: 4
  crs_reporting_level: 4
  crs_max_num_args: 255
  crs_arg_name_length: 100
  crs_arg_length: 1000
  crs_total_arg_length: 64000
  crs_max_file_size: 10485760        # 10 Mo
  crs_combined_file_sizes: 20970520  # 20 Mo
  crs_sampling_percentage: 100
  crs_allow_method_override_parameter: 0
  crs_allowed_methods:
  # These variables can be used for adding and removing methods from the list:
  # crs_allowed_methods_add: ["XXX"]
  # crs_allowed_methods_del: ["YYY"]
    - "GET"
    - "HEAD"
    - "POST"
    - "OPTIONS"
  crs_allowed_request_content_type:
  # These variables can be used for adding and removing content types from the list:
  # crs_allowed_request_content_type_add: ["|xxx/yyy|"]
  # crs_allowed_request_content_type_del: ["|zzz/aaa|"]
    - "|application/json|"
    - "|application/soap+xml|"
    - "|application/x-www-form-urlencoded|"
    - "|application/xml|"
    - "|multipart/form-data|"
    - "|text/xml|"
  crs_restricted_extensions:
  # These variables can be used for adding and removing extensions from the list:
  # crs_restricted_extensions_add: [".xxx/"]
  # crs_restricted_extensions_del: [".yyy/"]
    - ".ani/"
    - ".asa/"
    - ".asax/"
    - ".ascx/"
    - ".back/"
    - ".backup/"
    - ".bak/"
    - ".bat/"
    - ".bck/"
    - ".bk/"
    - ".bkp/"
    - ".cdx/"
    - ".cer/"
    - ".cfg/"
    - ".cmd/"
    - ".cnf/"
    - ".com/"
    - ".compositefont/"
    - ".conf/"
    - ".config/"
    - ".copy/"
    - ".crt/"
    - ".cs/"
    - ".csproj/"
    - ".csr/"
    - ".dat/"
    - ".db/"
    - ".dbf/"
    - ".dist/"
    - ".dll/"
    - ".dos/"
    - ".dpkg-dist/"
    - ".drv/"
    - ".gadget/"
    - ".hta/"
    - ".htr/"
    - ".htw/"
    - ".ida/"
    - ".idc/"
    - ".idq/"
    - ".inc/"
    - ".inf/"
    - ".ini/"
    - ".jks/"
    - ".jse/"
    - ".key/"
    - ".licx/"
    - ".lnk/"
    - ".log/"
    - ".mdb/"
    - ".msc/"
    - ".ocx/"
    - ".old/"
    - ".pass/"
    - ".pdb/"
    - ".pem/"
    - ".pfx/"
    - ".pif/"
    - ".pol/"
    - ".prf/"
    - ".printer/"
    - ".pwd/"
    - ".rdb/"
    - ".rdp/"
    - ".reg/"
    - ".resources/"
    - ".resx/"
    - ".sav/"
    - ".save/"
    - ".scr/"
    - ".sct/"
    - ".sh/"
    - ".shs/"
    - ".sql/"
    - ".sqlite/"
    - ".sqlite3/"
    - ".swap/"
    - ".swo/"
    - ".swp/"
    - ".sys/"
    - ".temp/"
    - ".tfstate/"
    - ".tlb/"
    - ".tmp/"
    - ".vb/"
    - ".vbe/"
    - ".vbproj/"
    - ".vbs/"
    - ".vsdisco/"
    - ".vxd/"
    - ".webinfo/"
    - ".ws/"
    - ".wsc/"
    - ".wsf/"
    - ".wsh/"
    - ".xsd/"
    - ".xsx/"
  crs_restricted_headers_basic:
  # These variables can be used for adding and removing headers from the list:
  # crs_restricted_headers_basic_add: ["/xxx/"]
  # crs_restricted_headers_basic_del: ["/yyy/"]
    - "/content-encoding/"
    - "/content-range/"
    - "/expect/"
    - "/if/"
    - "/lock-token/"
    - "/proxy/"
    - "/x-http-method-override/"
    - "/x-http-method/"
    - "/x-method-override/"
    - "/x-middleware-subrequest/"
  crs_restricted_headers_extended:
  # These variables can be used for adding and removing headers from the list:
  # crs_restricted_headers_extended_add: ["/xxx/"]
  # crs_restricted_headers_extended_del: ["/yyy/"]
    - "/accept-charset/"
  crs_allowed_http_versions:
  # These variables can be used for adding and removing protocols from the list:
  # crs_allowed_http_versions_add: ["HTTP/x.x"]
  # crs_allowed_http_versions_del: ["HTTP/y.y"]
    - "HTTP/1.0"
    - "HTTP/1.1"
    - "HTTP/2"
    - "HTTP/2.0"
    - "HTTP/3"
    - "HTTP/3.0"
  crs_allowed_request_content_type_charset:
  # These variables can be used for adding and removing charsets from the list:
  # crs_allowed_request_content_type_charset_add: ["|xxx|"]
  # crs_allowed_request_content_type_charset_del: ["|yyy|"]
    - "|utf-8|"
    - "|iso-8859-1|"
    - "|iso-8859-15|"
    - "|windows-1252|"

  # github.com/zhangjiayin/caddy-geoip2
  geoip: false
  geoip_debug: false
  geoip_filter_expression: '{geoip2.country_code} == "UNK"'