Disable Caddy admin endpoint

Author: AFCMS

Caddyfile

@@ -1,10 +1,10 @@
 {
 	auto_https off
+	admin off
 }
 
 :80 {
 	root * /srv
-	file_server
 	header {
 		# NOTE: Temporary relaxation — 'unsafe-eval' is required due to mediainfo.js using string eval in the worker.
 		# TODO: Remove 'unsafe-eval' from script-src once upstream mediainfo.js patches this behavior.
@@ -16,5 +16,16 @@
 		Cross-Origin-Resource-Policy "same-origin"
 		Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
 	}
+
+	# Restrict allowed HTTP methods to safe ones for static content
+	@disallowed_methods {
+		not method GET HEAD OPTIONS
+	}
+	header @disallowed_methods {
+		Allow "GET, HEAD, OPTIONS"
+	}
+	respond @disallowed_methods 405
+
+	file_server
 	try_files {path} /index.html
 }

Dockerfile

@@ -31,20 +31,9 @@ RUN pnpm build
 
 FROM caddy:2-alpine
 
-RUN adduser \
-    --gecos "" \
-    --system \
-    --no-create-home \
-    --uid "900" \
-    "appuser"
+COPY --from=builder /app/dist /srv
 
-USER appuser
-
-COPY --from=builder --chown=appuser:appuser /app/dist /srv
-
-# COPY --chown=appuser:appuser dist /srv
-
-COPY --chown=appuser:appuser Caddyfile /etc/caddy/Caddyfile
+COPY Caddyfile /etc/caddy/Caddyfile
 
 EXPOSE 80