chore(deploy): add rate limiting and session nonce injection

lukeocodes · lukeocodes · commit a5c70e0b1d32 · 2026-02-10T11:48:22.000Z
diff --git a/deploy/Caddyfile b/deploy/Caddyfile
@@ -1,15 +1,41 @@
+{
+	order rate_limit before basicauth
+}
+
 :8080 {
-	# HTML page served by backend (injects session nonce)
+	# HTML page: Caddy templates inject base path + session nonce
 	@htmlpage {
 		path /
 		path /index.html
 	}
 	handle @htmlpage {
+		templates
+		root * /app/frontend/dist
+		rewrite * /index.html
+		file_server
+	}
+
+	# Session endpoint: 5 req/min per IP
+	handle /api/session {
+		rate_limit {
+			zone session {
+				key {remote_host}
+				events 5
+				window 1m
+			}
+		}
 		reverse_proxy localhost:{$BACKEND_PORT:8081}
 	}
 
-	# API endpoints proxied to backend
+	# API endpoints: 30 req/min per IP
 	handle /api/* {
+		rate_limit {
+			zone api {
+				key {remote_host}
+				events 30
+				window 1m
+			}
+		}
 		reverse_proxy localhost:{$BACKEND_PORT:8081}
 	}
 
@@ -19,4 +45,3 @@
 		file_server
 	}
 }
-
diff --git a/deploy/Dockerfile b/deploy/Dockerfile
@@ -1,24 +1,27 @@
-# Stage 1: Build frontend
+# Stage 1: Build custom Caddy with rate limiting module
+FROM golang:1.25-alpine AS caddy-builder
+WORKDIR /build
+RUN go install github.com/caddyserver/xcaddy/cmd/xcaddy@latest
+RUN xcaddy build --with github.com/mholt/caddy-ratelimit
+# Binary output: /build/caddy
+
+# Stage 2: Build frontend
 FROM node:24-slim AS frontend-builder
 RUN corepack enable
 WORKDIR /build
 COPY frontend/package.json frontend/pnpm-lock.yaml ./frontend/
 RUN cd frontend && pnpm install --frozen-lockfile
 COPY frontend/ ./frontend/
 RUN cd frontend && pnpm build
+# Inject Caddy template directives for subpath base path + session nonce
+RUN sed -i 's|<head>|<head>\n  <base href="{{ .Req.Header.Get "X-Base-Path" }}">\n  <meta name="session-nonce" content="{{ placeholder "http.request.uuid" }}">|' ./frontend/dist/index.html
 
-# Stage 2: Runtime
+# Stage 3: Runtime
 FROM node:24-slim
 RUN corepack enable
 
-# Install Caddy
-RUN apt-get update && \
-    apt-get install -y debian-keyring debian-archive-keyring apt-transport-https curl && \
-    curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg && \
-    curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | tee /etc/apt/sources.list.d/caddy-stable.list && \
-    apt-get update && \
-    apt-get install -y caddy && \
-    apt-get clean && rm -rf /var/lib/apt/lists/*
+# Copy custom Caddy binary
+COPY --from=caddy-builder /build/caddy /usr/bin/caddy
 
 WORKDIR /app
 
