Update caddyfiles

caddy/Caddyfile.auth

@@ -1,9 +1,4 @@
 {
-	on_demand_tls {
-		ask http://web:3000/check
-		interval 1m
-		burst 10
-	}
 	servers {
 		metrics
 	}
@@ -129,11 +124,3 @@
 		Access-Control-Allow-Headers "*"
 	}
 }
-
-:443 {
-	reverse_proxy web:3000
-	tls {$APP_EMAIL} {
-		on_demand
-	}
-	encode zstd gzip
-}

caddy/Caddyfile.pico

@@ -1,4 +1,4 @@
-{$APP_DOMAIN}, tmp.pico.sh {
+{$APP_DOMAIN} {
   reverse_proxy https://pico-docs-prod.pgs.sh {
     header_up Host pico-docs-prod.pgs.sh
   }

caddy/Caddyfile.pipe

@@ -0,0 +1,54 @@
+{
+	servers {
+		metrics
+	}
+}
+
+*.{$APP_DOMAIN}, {$APP_DOMAIN} {
+	reverse_proxy web:3000
+	tls {$APP_EMAIL} {
+		dns cloudflare {$CF_API_TOKEN}
+		resolvers 1.1.1.1
+	}
+	encode zstd gzip
+
+	header {
+		# disable FLoC tracking
+		Permissions-Policy interest-cohort=()
+
+		# enable HSTS
+		Strict-Transport-Security max-age=31536000;
+
+		# disable clients from sniffing the media type
+		X-Content-Type-Options nosniff
+
+		# clickjacking protection
+		X-Frame-Options DENY
+
+		# keep referrer data off of HTTP connections
+		Referrer-Policy no-referrer-when-downgrade
+
+		Content-Security-Policy "default-src 'self'; img-src * 'unsafe-inline'; style-src * 'unsafe-inline'"
+
+		X-XSS-Protection "1; mode=block"
+	}
+
+	@caddymetrics {
+		host {$APP_DOMAIN}
+		path /_caddy/metrics
+	}
+
+	metrics @caddymetrics {
+		disable_openmetrics
+	}
+
+	@appmetrics {
+		host {$APP_DOMAIN}
+		path /_app/metrics
+	}
+
+	handle @appmetrics {
+		rewrite * /metrics
+		reverse_proxy ssh:9222
+	}
+}