Caddyfile

{
	auto_https off
	admin localhost:2019
}

:8080 {
	log {
		output stdout
		format json
		level WARN
	}

	handle {
		header -Server
	}

	route {
		waf {
			anomaly_threshold 10
			block_countries GeoLite2-Country.mmdb RU CN KP
			# whitelist_countries GeoLite2-Country.mmdb US
			rate_limit 10000 1m 5m
			rule_file rules.json
			# rule_file rules/wordpress.json
			ip_blacklist_file ip_blacklist.txt
			dns_blacklist_file dns_blacklist.txt
			log_severity warn
			log_json
			log_path debug.json
			# redact_sensitive_data
		}

		respond "Hello, world!" 200
	}

	header {
		Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
		X-Frame-Options "DENY"
		X-Content-Type-Options "nosniff"
		Referrer-Policy "no-referrer"
		Permissions-Policy "geolocation=(), microphone=(), camera=()"
		Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'"
		X-Permitted-Cross-Domain-Policies "none"
		Clear-Site-Data "\"cache\", \"cookies\", \"storage\""
		Cross-Origin-Embedder-Policy "require-corp"
		Cross-Origin-Opener-Policy "same-origin"
		Cross-Origin-Resource-Policy "same-origin"
	}
}