1{
  2	servers {
  3		metrics
  4	}
  5}
  6
  7# Metrics routes need ?x-authorization={$METRICS_TOKEN}. An unset token matches
  8# nothing.
  9(metrics_token) {
 10	expression `{http.request.uri.query.x-authorization} == "{$METRICS_TOKEN}" && "{$METRICS_TOKEN}" != ""`
 11}
 12
 13# Apps serve metrics on /_metrics, which only the token-checked routes reach.
 14# Scrapes stay out of the access logs so the token does too.
 15(block_app_metrics) {
 16	@appmetrics path /_metrics /_metrics/*
 17	respond @appmetrics 404
 18	@metricsroutes path /_caddy/metrics /_ssh/metrics /_web/metrics /_imgproxy/metrics /_app/metrics
 19	log_skip @metricsroutes
 20}
 21
 22*.pico.sh, pico.sh {
 23	import block_app_metrics
 24	@auth {
 25		host auth.pico.sh
 26	}
 27
 28	@irc {
 29		host irc.pico.sh
 30	}
 31
 32	@ircmetrics {
 33		host irc.pico.sh
 34		path /_app/metrics
 35		import metrics_token
 36	}
 37
 38	@options {
 39		method OPTIONS
 40	}
 41	respond @options 204
 42
 43	@caddymetrics {
 44		host auth.pico.sh
 45		path /_caddy/metrics
 46		import metrics_token
 47	}
 48
 49	metrics @caddymetrics {
 50		disable_openmetrics
 51	}
 52
 53	@webmetrics {
 54		host auth.pico.sh
 55		path /_web/metrics
 56		import metrics_token
 57	}
 58
 59	handle @webmetrics {
 60		rewrite * /_metrics
 61		reverse_proxy auth-web:3000
 62	}
 63
 64	reverse_proxy @auth auth-web:3000
 65
 66	reverse_proxy @irc https://bouncer:8080 {
 67		transport http {
 68			tls_insecure_skip_verify
 69		}
 70	}
 71
 72	handle @ircmetrics {
 73		rewrite * /metrics
 74		reverse_proxy bouncer:80
 75	}
 76
 77	tls {$APP_EMAIL} {
 78		dns cloudflare {$CF_API_TOKEN}
 79		resolvers 1.1.1.1
 80	}
 81	encode zstd gzip
 82
 83	header {
 84		# disable FLoC tracking
 85		Permissions-Policy interest-cohort=()
 86
 87		# enable HSTS
 88		Strict-Transport-Security max-age=31536000;
 89
 90		# disable clients from sniffing the media type
 91		X-Content-Type-Options nosniff
 92
 93		# clickjacking protection
 94		X-Frame-Options DENY
 95
 96		# keep referrer data off of HTTP connections
 97		Referrer-Policy no-referrer-when-downgrade
 98
 99		Content-Security-Policy "default-src 'self'; img-src * 'unsafe-inline'; style-src * 'unsafe-inline'"
100
101		X-XSS-Protection "1; mode=block"
102
103		Access-Control-Allow-Origin "https://chat.pico.sh"
104
105		Access-Control-Allow-Headers "*"
106	}
107}