e276195b6e
Systemd socket activation keeps the listening socket open across service restarts so connections queue at the kernel instead of getting 503s from Caddy. The Go server detects LISTEN_FDS and uses the inherited fd, falling back to normal listen for local dev. Caddy retry window bumped as a safety net. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
26 lines
755 B
Django/Jinja
26 lines
755 B
Django/Jinja
{{ app_domain }} {
|
|
# TLS via Cloudflare origin certificate
|
|
tls /etc/caddy/certs/origin.pem /etc/caddy/certs/origin-key.pem
|
|
|
|
# Compression
|
|
encode gzip zstd
|
|
|
|
# Security headers
|
|
header {
|
|
X-Content-Type-Options "nosniff"
|
|
X-Frame-Options "DENY"
|
|
Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
|
|
}
|
|
|
|
# Strip trailing slashes (redirect to canonical non-slash URL)
|
|
@trailing_slash path_regexp trailing ^(.+)/$
|
|
redir @trailing_slash {re.trailing.1} permanent
|
|
|
|
# Reverse proxy to Go app — retry during restarts for zero-downtime deploys
|
|
reverse_proxy {{ go_upstream_addr | default("localhost" ~ go_listen_addr) }} {
|
|
header_up X-Real-IP {remote_host}
|
|
lb_try_duration 10s
|
|
lb_try_interval 100ms
|
|
fail_duration 10s
|
|
}
|
|
}
|
