agento3/Caddyfile

# AO3 Mirror v5 - Caddy 配置
# 前端负载均衡 + TLS 终止 + Cloudflare CDN 集成 + Service Worker

agento3.miscs.dev {
	# 全局头
	header {
		Strict-Transport-Security "max-age=31536000; includeSubDomains"
		X-Content-Type-Options "nosniff"
		X-Frame-Options "SAMEORIGIN"
		X-XSS-Protection "1; mode=block"
		Referrer-Policy "strict-origin-when-cross-origin"
		Content-Security-Policy "default-src 'self'; script-src 'self' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; object-src 'none'"
		-Server
		-X-Powered-By
	}

	# 日志
	log {
		output file /var/log/ao3-mirror/access.log {
			roll_size 100mb
			roll_keep 7
			roll_keep_for 720h
		}
		format json
	}

	# 压缩
	encode gzip

	# Service Worker routes — versioned + redirect
	route /sw-* {
		reverse_proxy 127.0.0.1:8081 127.0.0.1:8082 {
			lb_policy round_robin
			health_uri /health
			health_interval 10s
			health_timeout 5s
			transport http {
				read_timeout 60s
				write_timeout 60s
				dial_timeout 5s
			}
		}
		header {
			Cache-Control "public, max-age=86400, immutable"
		}
	}

	# SW redirect
	route /sw.js {
		reverse_proxy 127.0.0.1:8081 127.0.0.1:8082 {
			lb_policy round_robin
			health_uri /health
			health_interval 10s
			health_timeout 5s
			transport http {
				read_timeout 60s
				write_timeout 60s
				dial_timeout 5s
			}
		}
		header {
			Cache-Control "no-store"
		}
	}

	# Mirror domains JSON
	route /mirror-domains.json {
		reverse_proxy 127.0.0.1:8081 127.0.0.1:8082 {
			lb_policy round_robin
			health_uri /health
			health_interval 10s
			health_timeout 5s
			transport http {
				read_timeout 60s
				write_timeout 60s
				dial_timeout 5s
			}
		}
		header {
			Cache-Control "public, max-age=3600"
		}
	}

	# 后端负载均衡 (轮询) - 2 workers on 2-core machine
	reverse_proxy 127.0.0.1:8081 127.0.0.1:8082 {
		lb_policy round_robin

		health_uri /health
		health_interval 10s
		health_timeout 5s

		# 超时配置 — 代理可能需要更长时间
		transport http {
			read_timeout 30s
			write_timeout 30s
			dial_timeout 5s
		}

		header_up X-Forwarded-For {remote_host}
		header_up X-Forwarded-Proto {scheme}
		header_up X-Real-IP {remote_host}
	}
}

# 统计子域名 - 监控面板和指标
stats.agento3.miscs.dev {
	# 安全头
	header {
		Strict-Transport-Security "max-age=31536000; includeSubDomains"
		X-Content-Type-Options "nosniff"
		X-Frame-Options "SAMEORIGIN"
		Referrer-Policy "strict-origin-when-cross-origin"
		Content-Security-Policy "default-src 'self'; script-src 'self' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; object-src 'none'"
		-Server
		-X-Powered-By
	}

	# 日志
	log {
		output file /var/log/ao3-mirror/stats-access.log {
			roll_size 100mb
			roll_keep 7
			roll_keep_for 720h
		}
		format json
	}

	# 压缩
	encode gzip

	# 路由规则 - 只暴露 /stats, /metrics, /health, /sw
	route {
		# /stats 页面
		reverse_proxy /stats* 127.0.0.1:8081 127.0.0.1:8082 {
			lb_policy round_robin
			health_uri /health
			health_interval 10s
			health_timeout 5s
			transport http {
				read_timeout 60s
				write_timeout 60s
				dial_timeout 5s
			}
			header_up X-Forwarded-For {remote_host}
			header_up X-Forwarded-Proto {scheme}
			header_up X-Real-IP {remote_host}
		}

		# /metrics 指标
		reverse_proxy /metrics* 127.0.0.1:8081 127.0.0.1:8082 {
			lb_policy round_robin
			health_uri /health
			health_interval 10s
			health_timeout 5s
			transport http {
				read_timeout 60s
				write_timeout 60s
				dial_timeout 5s
			}
			header_up X-Forwarded-For {remote_host}
			header_up X-Forwarded-Proto {scheme}
			header_up X-Real-IP {remote_host}
		}

		# Service Worker
		reverse_proxy /sw* 127.0.0.1:8081 127.0.0.1:8082 {
			lb_policy round_robin
			health_uri /health
			health_interval 10s
			health_timeout 5s
			transport http {
				read_timeout 60s
				write_timeout 60s
				dial_timeout 5s
			}
			header_up X-Forwarded-For {remote_host}
			header_up X-Forwarded-Proto {scheme}
			header_up X-Real-IP {remote_host}
		}

		# Mirror domains
		reverse_proxy /mirror-domains* 127.0.0.1:8081 127.0.0.1:8082 {
			lb_policy round_robin
			health_uri /health
			health_interval 10s
			health_timeout 5s
			transport http {
				read_timeout 60s
				write_timeout 60s
				dial_timeout 5s
			}
			header_up X-Forwarded-For {remote_host}
			header_up X-Forwarded-Proto {scheme}
			header_up X-Real-IP {remote_host}
		}

		# 健康检查
		respond /health* 200 {
			body `{"status":"ok"}`
		}

		# 其他路径返回 404
		respond * 404
	}
}