|
| 1 | +{ |
| 2 | + # disable automatic SSL certificate generation |
| 3 | + auto_https off |
| 4 | + # disable admin API server |
| 5 | + admin off |
| 6 | + |
| 7 | + # set default SNI for old clients |
| 8 | + default_sni {$GITPOD_DOMAIN} |
| 9 | + |
| 10 | + # debug |
| 11 | + |
| 12 | + # configure plugin order |
| 13 | + # https://caddyserver.com/docs/caddyfile/directives#directive-order |
| 14 | + order gitpod.cors_origin before header |
| 15 | + order gitpod.workspace_download before redir |
| 16 | +} |
| 17 | + |
| 18 | +(compression) { |
| 19 | + encode zstd gzip |
| 20 | +} |
| 21 | + |
| 22 | +# configure headers to force HTTPS and enable more strict rules for the browser |
| 23 | +(security_headers) { |
| 24 | + header { |
| 25 | + # enable HSTS |
| 26 | + Strict-Transport-Security max-age=31536000 |
| 27 | + # disable clients from sniffing the media type |
| 28 | + X-Content-Type-Options nosniff |
| 29 | + # Define valid parents that may embed a page |
| 30 | + Content-Security-Policy "frame-ancestors self https://*.{$GITPOD_DOMAIN} https://{$GITPOD_DOMAIN}" |
| 31 | + # keep referrer data off of HTTP connections |
| 32 | + Referrer-Policy no-referrer-when-downgrade |
| 33 | + # Enable cross-site filter (XSS) and tell browser to block detected attacks |
| 34 | + X-XSS-Protection "1; mode=block" |
| 35 | + |
| 36 | + defer # delay changes |
| 37 | + } |
| 38 | +} |
| 39 | + |
| 40 | +(enable_log) { |
| 41 | + log { |
| 42 | + output stdout |
| 43 | + format filter { |
| 44 | + wrap json |
| 45 | + fields { |
| 46 | + logger delete |
| 47 | + msg delete |
| 48 | + size delete |
| 49 | + status delete |
| 50 | + resp_headers delete |
| 51 | + request delete |
| 52 | + } |
| 53 | + } |
| 54 | + } |
| 55 | +} |
| 56 | + |
| 57 | +(remove_server_header) { |
| 58 | + header { |
| 59 | + -server |
| 60 | + -x-powered-by |
| 61 | + } |
| 62 | +} |
| 63 | + |
| 64 | +(ssl_configuration) { |
| 65 | + tls /etc/caddy/certificates/tls.crt /etc/caddy/certificates/tls.key { |
| 66 | + #ca_root <pem_file> |
| 67 | + } |
| 68 | +} |
| 69 | + |
| 70 | +(upstream_headers) { |
| 71 | + header_up X-Real-IP {http.request.remote.host} |
| 72 | +} |
| 73 | + |
| 74 | +(upstream_connection) { |
| 75 | + lb_try_duration 1s |
| 76 | +} |
| 77 | + |
| 78 | +(debug_headers) { |
| 79 | + header X-Gitpod-Region {$GITPOD_INSTALLATION_LONGNAME} |
| 80 | +} |
| 81 | + |
| 82 | +# Kubernetes health-check |
| 83 | +:8003 { |
| 84 | + respond /live 200 |
| 85 | + respond /ready 200 |
| 86 | +} |
| 87 | + |
| 88 | +# always redirect to HTTPS |
| 89 | +http:// { |
| 90 | + redir https://{host}{uri} permanent |
| 91 | +} |
| 92 | + |
| 93 | +https://{$GITPOD_DOMAIN} { |
| 94 | + import enable_log |
| 95 | + import remove_server_header |
| 96 | + import ssl_configuration |
| 97 | + import security_headers |
| 98 | + |
| 99 | + @workspace_download path /workspace-download* |
| 100 | + handle @workspace_download { |
| 101 | + header { |
| 102 | + # The browser needs to see the correct archive content type to trigger the download. |
| 103 | + content-type "application/tar+gzip" |
| 104 | + -x-guploader-uploadid |
| 105 | + -etag |
| 106 | + -x-goog-generation |
| 107 | + -x-goog-metageneration |
| 108 | + -x-goog-hash |
| 109 | + -x-goog-stored-content-length |
| 110 | + -x-gitpod-region |
| 111 | + -x-goog-stored-content-encoding |
| 112 | + -x-goog-storage-class |
| 113 | + -x-goog-generation |
| 114 | + -x-goog-metageneration |
| 115 | + -cache-control |
| 116 | + -expires |
| 117 | + |
| 118 | + defer # delay changes |
| 119 | + } |
| 120 | + |
| 121 | + gitpod.workspace_download { |
| 122 | + service http://server.{$KUBE_NAMESPACE}.{$KUBE_DOMAIN}:3000 |
| 123 | + } |
| 124 | + |
| 125 | + redir {http.gitpod.workspace_download_url} 303 |
| 126 | + } |
| 127 | + |
| 128 | + @backend_wss path /api/gitpod |
| 129 | + handle @backend_wss { |
| 130 | + uri strip_prefix /api |
| 131 | + reverse_proxy server.{$KUBE_NAMESPACE}.{$KUBE_DOMAIN}:3000 { |
| 132 | + import upstream_headers |
| 133 | + } |
| 134 | + } |
| 135 | + |
| 136 | + @backend path /api/* /admin/* |
| 137 | + handle @backend { |
| 138 | + gitpod.cors_origin { |
| 139 | + base_domain {$GITPOD_DOMAIN} |
| 140 | + } |
| 141 | + |
| 142 | + import compression |
| 143 | + |
| 144 | + uri strip_prefix /api |
| 145 | + reverse_proxy server.{$KUBE_NAMESPACE}.{$KUBE_DOMAIN}:3000 { |
| 146 | + import upstream_headers |
| 147 | + import upstream_connection |
| 148 | + } |
| 149 | + } |
| 150 | + |
| 151 | + @codesync path /code-sync* |
| 152 | + handle @codesync { |
| 153 | + gitpod.cors_origin { |
| 154 | + base_domain {$GITPOD_DOMAIN} |
| 155 | + } |
| 156 | + |
| 157 | + import compression |
| 158 | + |
| 159 | + reverse_proxy server.{$KUBE_NAMESPACE}.{$KUBE_DOMAIN}:3000 { |
| 160 | + import upstream_headers |
| 161 | + import upstream_connection |
| 162 | + |
| 163 | + flush_interval -1 |
| 164 | + } |
| 165 | + } |
| 166 | + |
| 167 | + @to_server path /auth/github/callback /auth /auth/* /apps /apps/* |
| 168 | + handle @to_server { |
| 169 | + import compression |
| 170 | + |
| 171 | + reverse_proxy server.{$KUBE_NAMESPACE}.{$KUBE_DOMAIN}:3000 { |
| 172 | + import upstream_headers |
| 173 | + import upstream_connection |
| 174 | + } |
| 175 | + } |
| 176 | + |
| 177 | + handle { |
| 178 | + reverse_proxy dashboard.{$KUBE_NAMESPACE}.{$KUBE_DOMAIN}:3001 { |
| 179 | + import upstream_headers |
| 180 | + import upstream_connection |
| 181 | + } |
| 182 | + } |
| 183 | + |
| 184 | + handle_errors { |
| 185 | + redir https://{$GITPOD_DOMAIN}/sorry/#Error%20{http.reverse_proxy.status_text} 302 |
| 186 | + } |
| 187 | +} |
| 188 | + |
| 189 | +# workspaces |
| 190 | +https://*.*.{$GITPOD_DOMAIN} { |
| 191 | + import enable_log |
| 192 | + import security_headers |
| 193 | + import remove_server_header |
| 194 | + import ssl_configuration |
| 195 | + import debug_headers |
| 196 | + |
| 197 | + @workspace_blobserve header_regexp host Host ^blobserve.ws(?P<location>-[a-z0-9]+)?.{$GITPOD_DOMAIN} |
| 198 | + handle @workspace_blobserve { |
| 199 | + gitpod.cors_origin { |
| 200 | + base_domain {$GITPOD_DOMAIN} |
| 201 | + } |
| 202 | + |
| 203 | + reverse_proxy https://ws-proxy.{$KUBE_NAMESPACE}.{$KUBE_DOMAIN}:9090 { |
| 204 | + transport http { |
| 205 | + tls_insecure_skip_verify |
| 206 | + } |
| 207 | + |
| 208 | + import upstream_headers |
| 209 | + |
| 210 | + header_up X-WSProxy-Host {http.request.host} |
| 211 | + |
| 212 | + header_down -access-control-allow-origin |
| 213 | + } |
| 214 | + } |
| 215 | + |
| 216 | + @workspace_port header_regexp host Host ^(webview-|browser-|extensions-)?(?P<workspacePort>[0-9]{2,5})-(?P<workspaceID>[a-z0-9][0-9a-z\-]+).ws(?P<location>-[a-z0-9]+)?.{$GITPOD_DOMAIN} |
| 217 | + handle @workspace_port { |
| 218 | + reverse_proxy ws-{re.host.workspaceID}-ports.{$KUBE_NAMESPACE}.{$KUBE_DOMAIN}:{re.host.workspacePort} { |
| 219 | + import upstream_headers |
| 220 | + |
| 221 | + header_up X-Gitpod-WorkspaceId {re.host.workspaceID} |
| 222 | + header_up X-Gitpod-Port {re.host.workspacePort} |
| 223 | + header_up X-WSProxy-Host {http.request.host} |
| 224 | + } |
| 225 | + } |
| 226 | + |
| 227 | + @workspace header_regexp host Host ^(webview-|browser-|extensions-)?(?P<workspaceID>[a-z0-9][0-9a-z\-]+).ws(?P<location>-[a-z0-9]+)?.{$GITPOD_DOMAIN} |
| 228 | + handle @workspace { |
| 229 | + reverse_proxy https://ws-proxy.{$KUBE_NAMESPACE}.{$KUBE_DOMAIN}:9090 { |
| 230 | + transport http { |
| 231 | + tls_insecure_skip_verify |
| 232 | + } |
| 233 | + |
| 234 | + import upstream_headers |
| 235 | + |
| 236 | + header_up X-Gitpod-WorkspaceId {re.host.workspaceID} |
| 237 | + header_up X-WSProxy-Host {http.request.host} |
| 238 | + } |
| 239 | + } |
| 240 | + |
| 241 | + respond "Not found" 404 |
| 242 | +} |
| 243 | + |
| 244 | +import /etc/caddy/vhosts/vhost.* |
0 commit comments