Erich Blume
696bc49290
Authentik's frontend uses content-hashed JS chunks, but the HTML pages that reference them had no Cache-Control headers. When the server restarts with new chunk hashes, browsers serve stale cached HTML that 404s on old chunk names, showing a throbber instead of the login form. Set Cache-Control: no-cache on /if/* (HTML flow pages) so browsers always revalidate, and Cache-Control: immutable on /static/dist/* (hashed assets) for efficient caching. Adds a reusable `cache_policy: spa` option to caddy_services. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
67 lines
1.7 KiB
Django/Jinja
67 lines
1.7 KiB
Django/Jinja
# Caddy reverse proxy for blumeops services
|
|
# Managed by ansible - do not edit manually
|
|
#
|
|
# All *.{{ caddy_domain }} requests are proxied to backend services.
|
|
# TLS certificates are obtained via ACME DNS-01 challenge using Gandi.
|
|
|
|
{
|
|
# Global options
|
|
admin off
|
|
|
|
{% if caddy_tcp_services %}
|
|
# Layer 4 (TCP) routing
|
|
layer4 {
|
|
{% for tcp_svc in caddy_tcp_services %}
|
|
:{{ tcp_svc.port }} {
|
|
route {
|
|
proxy {{ tcp_svc.backend }}
|
|
}
|
|
}
|
|
{% endfor %}
|
|
}
|
|
{% endif %}
|
|
}
|
|
|
|
# Wildcard certificate for all services
|
|
*.{{ caddy_domain }}:{{ caddy_https_port }} {
|
|
tls {
|
|
dns gandi {env.GANDI_BEARER_TOKEN}
|
|
}
|
|
|
|
{% for service in caddy_services %}
|
|
@{{ service.name }} host {{ service.host }}
|
|
handle @{{ service.name }} {
|
|
{% if service.cache_policy | default('') == 'spa' %}
|
|
# SPA cache policy: hashed static assets are immutable, HTML must revalidate.
|
|
# Prevents stale HTML from referencing chunk hashes that no longer exist.
|
|
@{{ service.name }}_static path /static/dist/*
|
|
header @{{ service.name }}_static Cache-Control "public, max-age=31536000, immutable"
|
|
@{{ service.name }}_html path /if/*
|
|
header @{{ service.name }}_html Cache-Control "no-cache"
|
|
{% endif %}
|
|
{% if service.backend.startswith('https://') %}
|
|
reverse_proxy {{ service.backend }} {
|
|
# Caddy v2.11+ rewrites Host to upstream for HTTPS backends.
|
|
# Preserve the original Host so services see *.ops.eblu.me.
|
|
header_up Host {http.request.host}
|
|
}
|
|
{% else %}
|
|
reverse_proxy {{ service.backend }}
|
|
{% endif %}
|
|
}
|
|
|
|
{% endfor %}
|
|
# Fallback for unknown hosts
|
|
handle {
|
|
respond "Unknown service" 404
|
|
}
|
|
}
|
|
|
|
# Base domain (ops.eblu.me)
|
|
{{ caddy_domain }}:{{ caddy_https_port }} {
|
|
tls {
|
|
dns gandi {env.GANDI_BEARER_TOKEN}
|
|
}
|
|
|
|
respond "blumeops services - use a subdomain (e.g., forge.{{ caddy_domain }})"
|
|
}
|