Caddyfile

# Global caddy config options must be first
{
    admin off
    auto_https off
}

# Bind to port 80
:80

# Serve static files
file_server

# Serve service-worker.js
handle /service-worker.js {
    file_server
}

# Fallback to index.html for everything but assets
@html {
  not path *.js *.css *.png *.jpg *.svg *.pdf *.gif *.eot *.ttf *.woff *.woff2 *.webmanifest *.json

  file index.html
}

handle_errors {
  header Cache-Control no-store
}

rewrite @html {http.matchers.file.relative}

# Cache languagefiles only for 1 day
header /assets/i18n/ Cache-Control "max-age=86400"

# Don't cache index.html and set CSP
header @html Cache-Control no-store
header @html Content-Security-Policy "
  default-src 'self';
  connect-src 'self'
    media.deso.org
    node.deso.org
    amp.deso.org
    pulse.deso.org
    bitclout.com:*
    api.bitclout.com
    pulse.bitclout.com
    https://altumbase.com
    https://openprosperapi.xyz
    api.bitpop.dev
    localhost:*
    explorer.bitclout.com:*
    megaswap.dev
    megaswap.xyz
    heroswap.com
    https://api.blockchain.com/ticker
    https://api.blockchain.com/mempool/fees
    https://ka-f.fontawesome.com/
    bitcoinfees.earn.com
    api.blockcypher.com
    amp.bitclout.com api.bitclout.green api.bitclout.blue
    amp.diamondapp.com
    api.bitclout.navy
    https://videodelivery.net
    https://lvpr.tv
    https://upload.videodelivery.net
    https://web3setu.co.in
    https://api2.amplitude.com/2/httpapi
    https://heapanalytics.com
    https://*.hotjar.com
    https://*.hotjar.io
    wss://*.hotjar.com
    https://diamondapp.com;
  script-src 'self'
    https://kit.fontawesome.com/5209775539.js
    https://ka-f.fontawesome.com/
    https://script.hotjar.com/modules.352fddba5b21bbfc3a08.js
    https://cdn.heapanalytics.com
    https://heapanalytics.com
    https://static.hotjar.com
    https://script.hotjar.com;
  style-src 'self'
    'unsafe-inline'
    https://fonts.googleapis.com
    https://heapanalytics.com
    https://static.hotjar.com
    https://script.hotjar.com
    https://cdn.jsdelivr.net/npm/bootstrap@4.6.0/dist/css/bootstrap.min.css;
  media-src 'self'
    videos.deso.org
    *.mypinata.cloud;
  img-src 'self'
    data:
    i.imgur.com
    images.deso.org
    media.deso.org
    node.deso.org
    images.bitclout.com
    quickchart.io
    arweave.net
    *.arweave.net
    entre-app-media-dev.s3.us-east-2.amazonaws.com
    s3.amazonaws.com
    *.pearl.app
    *.twimg.com
    cloudflare-ipfs.com
    https://heapanalytics.com
    https://static.hotjar.com
    https://script.hotjar.com
    https://icotar.com
    *.mypinata.cloud;
  font-src 'self'
    https://fonts.googleapis.com
    https://fonts.gstatic.com
    https://heapanalytics.com
    https://script.hotjar.com
    https://ka-f.fontawesome.com;
  frame-src 'self'
    localhost:*
    identity.deso.org
    identity.deso.run
    identity.deso.blue
    identity.deso.green
    identity.bitclout.com
    identity.bitclout.blue
    identity.bitclout.green
    megaswap.dev
    megaswap.xyz
    heroswap.com
    https://geo.captcha-delivery.com
    https://www.youtube.com
    https://iframe.videodelivery.net/
    https://lvpr.tv
    https://youtube.com
    https://player.vimeo.com
    https://www.tiktok.com
    https://giphy.com
    https://open.spotify.com
    https://embed-standalone.spotify.com
    https://w.soundcloud.com
    https://player.twitch.tv
    https://clips.twitch.tv
    https://mousai.stream
    https://vars.hotjar.com
    https://iframe.videodelivery.net;
  frame-ancestors 'self';"