Caddyfile

0.0.0.0:5000 {
    root /app
    tls off
    gzip
    log stdout
    errors stdout

    rewrite {
        if {file} not favicon.ico
        if {path} not /dist/app.bundle.js
        if {path} not /dist/app.bundle.js.map
        regexp .*
        to /
    }

    # security headers
    header / {
        # Enable HTTP Strict Transport Security (HSTS) to force clients to always connect via HTTPS
        Strict-Transport-Security "max-age=7776000;"
        # Enable cross-site filter (XSS) and tell browser to block detected attacks
        #X-XSS-Protection "1; mode=block"
        # Prevent some browsers from MIME-sniffing a response away from the declared Content-Type
        X-Content-Type-Options "nosniff"
        # Disallow the site to be rendered within a frame (clickjacking protection)
        X-Frame-Options "DENY"
        # Pin the Let's Encrypt Public cert for 90 days
        Public-Key-Pins "pin-sha256='C5+lpZ7tcVwmwQIMcRtPbsQtWLABXhQzejna0wHFr8M='; pin-sha256='YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg='; max-age=7776000"
        # Set customer server name
        Server "🦄"
        Referrer-Policy "no-referrer"
    }
}