Caddyfile

# Global caddy config options must be first
{
  admin off
  auto_https off
}

# Bind to port 82
:82

# Serve static files
file_server

# Fallback to index.html for everything but assets
@html {
  not path *.js *.css *.png *.svg *.ttf *.woff2

  file index.html
}

handle_errors {
  header Cache-Control no-store
}

rewrite @html {http.matchers.file.relative}

# Don't cache index.html and set CSP
header @html Cache-Control no-store
header @html Content-Security-Policy "
  default-src 'self';
  connect-src
    {$DOMAIN:https://node.deso.org}/api/v0/get-users-stateless
    {$DOMAIN:https://node.deso.org}/api/v0/get-app-state
    {$DOMAIN:https://node.deso.org}/api/v0/jumio-begin
    {$DOMAIN:https://node.deso.org}/api/v0/jumio-flow-finished
    {$DOMAIN:https://node.deso.org}/api/v0/get-referral-info-for-referral-hash
    {$DOMAIN:https://node.deso.org}/api/v0/get-user-derived-keys
    {$DOMAIN:https://node.deso.org}/api/v0/get-transaction-spending
    {$DOMAIN:https://node.deso.org}/api/v0/send-phone-number-verification-text
    {$DOMAIN:https://node.deso.org}/api/v0/submit-phone-number-verification-code
    {$DOMAIN:https://node.deso.org}/api/v0/get-transaction-spending-limit-hex-string
    {$DOMAIN:https://node.deso.org}/api/v0/get-transaction-spending-limit-response-from-hex/
    {$DOMAIN:https://node.deso.org}/api/v0/get-single-post
    {$DOMAIN:https://node.deso.org}/api/v0/get-exchange-rate
    {$DOMAIN:https://node.deso.org}/api/v0/query-eth-rpc
    {$DOMAIN:https://node.deso.org}/api/v0/submit-eth-tx
    {$DOMAIN:https://node.deso.org}/api/v0/get-access-bytes
    {$DOMAIN:https://node.deso.org}/api/v0/send-starter-deso-for-metamask-account
    {$DOMAIN:https://node.deso.org}/api/v0/authorize-derived-key
    {$DOMAIN:https://node.deso.org}/api/v0/get-txn
    {$DOMAIN:https://node.deso.org}/api/v0/verify-captcha
    {$DOMAIN:https://node.deso.org}/api/v0/get-bulk-messaging-public-keys
    {$DOMAIN:https://node.deso.org}/api/v0/submit-transaction
    https://test.deso.org/api/v0/get-users-stateless
    https://test.deso.org/api/v0/get-app-state
    https://test.deso.org/api/v0/jumio-begin
    https://test.deso.org/api/v0/jumio-flow-finished
    https://test.deso.org/api/v0/get-referral-info-for-referral-hash
    https://test.deso.org/api/v0/get-user-derived-keys
    https://test.deso.org/api/v0/get-transaction-spending
    https://test.deso.org/api/v0/send-phone-number-verification-text
    https://test.deso.org/api/v0/submit-phone-number-verification-code
    https://test.deso.org/api/v0/get-transaction-spending-limit-hex-string
    https://test.deso.org/api/v0/get-transaction-spending-limit-response-from-hex/
    https://test.deso.org/api/v0/get-single-post
    https://test.deso.org/api/v0/get-exchange-rate
    https://test.deso.org/api/v0/query-eth-rpc
    https://test.deso.org/api/v0/submit-eth-tx
    https://test.deso.org/api/v0/get-access-bytes
    https://test.deso.org/api/v0/send-starter-deso-for-metamask-account
    https://test.deso.org/api/v0/authorize-derived-key
    https://test.deso.org/api/v0/get-txn
    https://test.deso.org/api/v0/verify-captcha
    https://test.deso.org/api/v0/get-bulk-messaging-public-keys
    https://test.deso.org/api/v0/submit-transaction
    https://www.googleapis.com/drive/v3/files
    https://www.googleapis.com/drive/v3/files/
    https://www.googleapis.com/upload/drive/v3/files
    https://desoverification.com/api/v0/verify-captcha
    https://api.blockchain.com/mempool/fees
    https://registry.walletconnect.com/
    https://explorer-api.walletconnect.com/
    wss://relay.walletconnect.com/;
  img-src 'self'
      {$DOMAIN:https://node.deso.org}/api/v0/get-single-profile-picture/
      https://test.deso.org/api/v0/get-single-profile-picture/
      i.imgur.com
      images.deso.org
      images.bitclout.com
      arweave.net
      *.arweave.net
      *.pearl.app
      cloudflare-ipfs.com
      https://explorer-api.walletconnect.com/;
  style-src 'self' 'unsafe-inline'
    https://fonts.googleapis.com
    https://cdn.jsdelivr.net/npm/bootstrap@4.6.0/dist/css/bootstrap.min.css;
  font-src 'self'
    https://fonts.googleapis.com
    https://fonts.gstatic.com
    https://ka-f.fontawesome.com;
  frame-src 'self'
    heroswap.com
    https://verify.walletconnect.com
    https://iframe.videodelivery.net
    https://hcaptcha.com/
    https://*.hcaptcha.com/;
  script-src 'self'
    https://hcaptcha.com
    https://*.hcaptcha.com;"