Caddyfile

{$HOST_NAME} {
    # This technically allows any caddy entry to be added here
    # But we'll just use it for TLS
    {$TLS_OPTS}

    encode gzip

    header {
        Strict-Transport-Security max-age=31536000;
        X-Content-Type-Options nosniff
        X-Frame-Options DENY
        Referrer-Policy no-referrer-when-downgrade
    }

    handle /agent-assets/* {
        reverse_proxy http://agent-server
    }

    handle /api/* {
        header Content-Security-Policy "default-src 'none'"
        reverse_proxy http://api:3000
    }

    handle {
        header Content-Security-Policy "default-src 'self'; object-src 'none'; script-src 'self' 'unsafe-eval'; img-src 'self' data:; style-src 'self' data: 'unsafe-inline'"
        root * /srv
        try_files {path} /index.html
        file_server
    }
}