sub2api/deploy/Caddyfile.juhe.pub

{
	servers {
		max_header_size 64KB
		timeouts {
			read_header 10s
			idle 2m
		}
	}
}

# Production domain
juhe.pub {
	# This baseline assumes clients connect directly to Caddy. When Caddy is
	# behind a CDN, configure explicit trusted proxy CIDRs and {client_ip} as
	# documented in EDGE_SECURITY.md; {remote_host} would otherwise be the CDN.
	# =========================================================================
	# TLS 安全配置
	# =========================================================================
	tls {
		# 仅使用 TLS 1.2 和 1.3
		protocols tls1.2 tls1.3

		# 优先使用的加密套件
		ciphers TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
	}

	# =========================================================================
	# 反向代理配置
	# =========================================================================
	reverse_proxy 127.0.0.1:8080 {
		# 健康检查
		health_uri /health
		health_interval 30s
		health_timeout 10s
		health_status 200

		# 负载均衡策略（单节点可忽略，多节点时有用）
		lb_policy round_robin
		lb_try_duration 5s
		lb_try_interval 250ms

		# 仅从实际 TCP 对端生成转发头，避免透传客户端伪造值。
		header_up X-Real-IP {remote_host}
		header_up X-Forwarded-For {remote_host}
		header_up X-Forwarded-Proto {scheme}
		header_up X-Forwarded-Host {host}
		# 连接池优化
		transport http {
			keepalive 120s
			keepalive_idle_conns 256
			read_buffer 16KB
			write_buffer 16KB
			compression off
		}

		# 故障转移
		fail_duration 30s
		max_fails 3
		unhealthy_status 500 502 503 504
	}

	# =========================================================================
	# 压缩配置
	# =========================================================================
	encode {
		zstd
		gzip 6
		minimum_length 256
		match {
			# 不使用 text/*，否则 text/event-stream 会被压缩并缓冲到流结束
			header Content-Type text/css*
			header Content-Type text/csv*
			header Content-Type text/html*
			header Content-Type text/javascript*
			header Content-Type text/markdown*
			header Content-Type text/plain*
			header Content-Type text/xml*
			header Content-Type application/json*
			header Content-Type application/javascript*
			header Content-Type application/xml*
			header Content-Type application/rss+xml*
			header Content-Type image/svg+xml*
		}
	}

	# =========================================================================
	# 请求大小限制 (防止大文件攻击)
	# =========================================================================
	request_body {
		max_size 256MB
	}

	# =========================================================================
	# 日志配置
	# =========================================================================
	log {
		output file /var/log/caddy/sub2api.log {
			roll_size 50mb
			roll_keep 10
			roll_keep_for 720h
		}
		format json
		level INFO
	}

	# =========================================================================
	# 错误处理
	# =========================================================================
	handle_errors {
		respond "{err.status_code} {err.status_text}"
	}
}