feat: prepare ARR for controlled public deployment

2026-07-29 16:38:05 +08:00
commit a701de9f0e
271 changed files with 48472 additions and 0 deletions
--- a/deploy/Caddyfile
+++ b/deploy/Caddyfile
@@ -0,0 +1,34 @@
+{
+	email {$ACME_EMAIL}
+}
+
+{$WEB_PUBLIC_HOST} {
+	encode zstd gzip
+
+	basic_auth {
+		{$WEB_BASIC_AUTH_USER} {$WEB_BASIC_AUTH_PASSWORD_HASH}
+	}
+
+	header {
+		Strict-Transport-Security "max-age=31536000; includeSubDomains"
+		X-Content-Type-Options "nosniff"
+		X-Frame-Options "DENY"
+		Referrer-Policy "no-referrer"
+		Permissions-Policy "camera=(), geolocation=(), microphone=()"
+		-Server
+	}
+
+	reverse_proxy web:8765
+}
+
+{$MCP_PUBLIC_HOST} {
+	header {
+		Strict-Transport-Security "max-age=31536000; includeSubDomains"
+		X-Content-Type-Options "nosniff"
+		X-Frame-Options "DENY"
+		Referrer-Policy "no-referrer"
+		-Server
+	}
+
+	reverse_proxy mcp:8890
+}