mwpastore · September 30, 2024 16:00 · anggiadiputra · Mar 13, 2019
diff --git a/00README.md b/00README.md
diff --git a/01CHANGES.md b/01CHANGES.md
diff --git a/caddy.service b/caddy.service
 [Unit]
 Description=Caddy HTTP/2 web server
 Documentation=https://caddyserver.com/docs
 After=network-online.target
 Wants=network-online.target systemd-networkd-wait-online.service

 [Service]
 Restart=on-failure
 StartLimitInterval=86400
 StartLimitBurst=5

 ; User and group the process will run as.
 User=www-data
 Group=www-data

 ; Letsencrypt-issued certificates will be written to this directory.
 Environment=CADDYPATH=/etc/ssl/caddy

 ; Always set "-root" to something safe in case it gets forgotten in the Caddyfile.
 ExecStart=/usr/local/bin/caddy -log stdout -http2=true -agree=true -conf=/etc/caddy/Caddyfile -root=/var/tmp
 ExecReload=/bin/kill -USR1 $MAINPID

 ; Limit the number of file descriptors; see `man systemd.exec` for more limit settings.
 LimitNOFILE=1048576
 ; Unmodified caddy is not expected to use more than that.
 LimitNPROC=64

 ; Use private /tmp and /var/tmp, which are discarded after caddy stops.
 PrivateTmp=true
 ; Use a minimal /dev
 PrivateDevices=true
 ; Hide /home, /root, and /run/user. Nobody will steal your SSH-keys.
 ProtectHome=true
 ; Make /usr, /boot, /etc and possibly some more folders read-only.
 ProtectSystem=full
 ; … except /etc/ssl/caddy, because we want Letsencrypt-certificates there.
 ;   This merely retains r/w access rights, it does not add any new. Must still be writable on the host!
 ReadWriteDirectories=/etc/ssl/caddy

 ; The following additional security directives only work with systemd v229 or later.
 ; They further retrict privileges that can be gained by caddy. Uncomment if you like.
 ; Note that you may have to add capabilities required by any plugins in use.
 CapabilityBoundingSet=CAP_NET_BIND_SERVICE
 AmbientCapabilities=CAP_NET_BIND_SERVICE
 NoNewPrivileges=true

 [Install]
 WantedBy=multi-user.target
diff --git a/Caddyfile b/Caddyfile
 www.example.com {
  tls [email protected] {
    # Android 4 and IE 8-10 only support TLS 1.0.
    # Change tls1.0 to tls1.1 (or remove this block entirely) for better privacy.
    protocols tls1.0 tls1.3
  }

  log / /var/www/example.com/logs/access.log "{combined}" {
    rotate_size 100 # rotate after 100 MB
    rotate_age  14  # keep log files for 14 days
    rotate_keep 10  # keep at most 10 log files
    rotate_compress
  }

  ipfilter /wp-admin /wp-login.php {
    rule allow
    ip 1:2:3:4::/56
    strict
  }

  ipfilter /wp-admin/admin-ajax.php {
    rule block # disallow nobody === allow everybody
  }

  ratelimit /wp-login.php 5 7 minute

  # Protect secrets against misconfiguration.
  internal /wp-config.php
  # Disable XML-RPC (assuming you're not using it).
  internal /xmlrpc.php

  proxy / localhost:6081 {
    transparent
  }
 }

 www.example.com:2020 {
  bind localhost

  tls off

  errors /var/www/example.com/logs/error.log {
    rotate_size 100 # rotate after 100 MB
    rotate_age  14  # keep log files for 14 days
    rotate_keep 10  # keep at most 10 log files
    rotate_compress
  }

  root /var/www/example.com/wordpress

  rewrite {
    if {path} not_match ^/wp-admin
    to {path} {path}/ /index.php?_url={uri}
  }

  fastcgi / /run/php/php7.0-fpm.sock php

  filter rule {
    content_type (?:text|javascript)
    search_pattern https?://(?:www\.)?example\.(?:com|net|org)
    replacement https://www.example.com
  }

  # Set caching directives for static content. Caddy will automatically add
  # Last-Modified and ETag headers for files on disk. Neat!
  header /wp-content Cache-Control "max-age=2592000, s-maxage=86400"
  header /wp-includes Cache-Control "max-age=2592000, s-maxage=86400"
  
  # XML-RPC is disabled, so delete the header that points to it.
  header / -X-Pingback
 }
diff --git a/default.vcl b/default.vcl
 vcl 4.0;

 backend default {
    .host = "localhost";
    .port = "2020";
 }

 sub vcl_backend_response {
    if (beresp.http.content-type ~ "text|javascript|json|svg+xml|icon|font" && beresp.http.content-type !~ "woff") {
        set beresp.do_gzip = true;
    }
    
    /*
     * Uncomment the following lines only if you've partitioned your Varnish
     * backend storage into multiple stevedores as described above.
     *
     * This takes advantage of the fact that PHP sets an X-Powered-By header
     * on its responses. If you've set `expose_php = Off' in your php.ini,
     * you'll need to find some other criteria to differentiate dynamic from
     * static requests. I recommend leaving it on and removing the header in
     * this conditional (the commented line) if it worries you.
     *
     * If this is working properly, varnishstat will show separate SMA.dynamic
     * and SMF.static key groups that change over time as requests are served.
     *
    if (beresp.http.x-powered-by) {
      set beresp.storage_hint = "dynamic";
      
      //unset beresp.http.x-powered-by;
    }
    else {
      set beresp.storage_hint = "static";
    }
     */
 }
diff --git a/wp-config.snippet.php b/wp-config.snippet.php
 /**
 * Insert *before* requiring wp-settings.php
 */
 if (strpos(strtolower($_SERVER['HTTP_X_FORWARDED_PROTO']), 'https') !== false) {
        $_SERVER['HTTPS'] = 'on';
 }

 define('FORCE_SSL_ADMIN', true);

 /** Sets up WordPress vars and included files. */
 require_once(ABSPATH . 'wp-settings.php');

 /**
 * Insert *after* requiring wp-settings.php
 *
 * Alternatively, you can add this to your child theme's functions.php, or into its own (mu) plugin.
 */
 if (function_exists('add_filter')) {
 	add_filter('addh_options', function($options) {
 		// Another plugin handles the Expires and Cache-Control headers, so disable them in the Add Headers plugin.
 		$options['add_expires_header'] = false;
 		$options['add_cache_control_header'] = false;

 		return $options;
 	});
 }
	[Unit]
	Description=Caddy HTTP/2 web server
	Documentation=https://caddyserver.com/docs
	After=network-online.target
	Wants=network-online.target systemd-networkd-wait-online.service

	[Service]
	Restart=on-failure
	StartLimitInterval=86400
	StartLimitBurst=5

	; User and group the process will run as.
	User=www-data
	Group=www-data

	; Letsencrypt-issued certificates will be written to this directory.
	Environment=CADDYPATH=/etc/ssl/caddy

	; Always set "-root" to something safe in case it gets forgotten in the Caddyfile.
	ExecStart=/usr/local/bin/caddy -log stdout -http2=true -agree=true -conf=/etc/caddy/Caddyfile -root=/var/tmp
	ExecReload=/bin/kill -USR1 $MAINPID

	; Limit the number of file descriptors; see `man systemd.exec` for more limit settings.
	LimitNOFILE=1048576
	; Unmodified caddy is not expected to use more than that.
	LimitNPROC=64

	; Use private /tmp and /var/tmp, which are discarded after caddy stops.
	PrivateTmp=true
	; Use a minimal /dev
	PrivateDevices=true
	; Hide /home, /root, and /run/user. Nobody will steal your SSH-keys.
	ProtectHome=true
	; Make /usr, /boot, /etc and possibly some more folders read-only.
	ProtectSystem=full
	; … except /etc/ssl/caddy, because we want Letsencrypt-certificates there.
	; This merely retains r/w access rights, it does not add any new. Must still be writable on the host!
	ReadWriteDirectories=/etc/ssl/caddy

	; The following additional security directives only work with systemd v229 or later.
	; They further retrict privileges that can be gained by caddy. Uncomment if you like.
	; Note that you may have to add capabilities required by any plugins in use.
	CapabilityBoundingSet=CAP_NET_BIND_SERVICE
	AmbientCapabilities=CAP_NET_BIND_SERVICE
	NoNewPrivileges=true

	[Install]
	WantedBy=multi-user.target
	www.example.com {
	tls [email protected] {
	# Android 4 and IE 8-10 only support TLS 1.0.
	# Change tls1.0 to tls1.1 (or remove this block entirely) for better privacy.
	protocols tls1.0 tls1.3
	}

	log / /var/www/example.com/logs/access.log "{combined}" {
	rotate_size 100 # rotate after 100 MB
	rotate_age 14 # keep log files for 14 days
	rotate_keep 10 # keep at most 10 log files
	rotate_compress
	}

	ipfilter /wp-admin /wp-login.php {
	rule allow
	ip 1:2:3:4::/56
	strict
	}

	ipfilter /wp-admin/admin-ajax.php {
	rule block # disallow nobody === allow everybody
	}

	ratelimit /wp-login.php 5 7 minute

	# Protect secrets against misconfiguration.
	internal /wp-config.php
	# Disable XML-RPC (assuming you're not using it).
	internal /xmlrpc.php

	proxy / localhost:6081 {
	transparent
	}
	}

	www.example.com:2020 {
	bind localhost

	tls off

	errors /var/www/example.com/logs/error.log {
	rotate_size 100 # rotate after 100 MB
	rotate_age 14 # keep log files for 14 days
	rotate_keep 10 # keep at most 10 log files
	rotate_compress
	}

	root /var/www/example.com/wordpress

	rewrite {
	if {path} not_match ^/wp-admin
	to {path} {path}/ /index.php?_url={uri}
	}

	fastcgi / /run/php/php7.0-fpm.sock php

	filter rule {
	content_type (?:text\|javascript)
	search_pattern https?://(?:www\.)?example\.(?:com\|net\|org)
	replacement https://www.example.com
	}

	# Set caching directives for static content. Caddy will automatically add
	# Last-Modified and ETag headers for files on disk. Neat!
	header /wp-content Cache-Control "max-age=2592000, s-maxage=86400"
	header /wp-includes Cache-Control "max-age=2592000, s-maxage=86400"

	# XML-RPC is disabled, so delete the header that points to it.
	header / -X-Pingback
	}
	vcl 4.0;

	backend default {
	.host = "localhost";
	.port = "2020";
	}

	sub vcl_backend_response {
	if (beresp.http.content-type ~ "text\|javascript\|json\|svg+xml\|icon\|font" && beresp.http.content-type !~ "woff") {
	set beresp.do_gzip = true;
	}

	/*
	* Uncomment the following lines only if you've partitioned your Varnish
	* backend storage into multiple stevedores as described above.
	*
	* This takes advantage of the fact that PHP sets an X-Powered-By header
	* on its responses. If you've set `expose_php = Off' in your php.ini,
	* you'll need to find some other criteria to differentiate dynamic from
	* static requests. I recommend leaving it on and removing the header in
	* this conditional (the commented line) if it worries you.
	*
	* If this is working properly, varnishstat will show separate SMA.dynamic
	* and SMF.static key groups that change over time as requests are served.
	*
	if (beresp.http.x-powered-by) {
	set beresp.storage_hint = "dynamic";

	//unset beresp.http.x-powered-by;
	}
	else {
	set beresp.storage_hint = "static";
	}
	*/
	}
	/**
	* Insert before requiring wp-settings.php
	*/
	if (strpos(strtolower($_SERVER['HTTP_X_FORWARDED_PROTO']), 'https') !== false) {
	$_SERVER['HTTPS'] = 'on';
	}

	define('FORCE_SSL_ADMIN', true);

	/** Sets up WordPress vars and included files. */
	require_once(ABSPATH . 'wp-settings.php');

	/**
	* Insert after requiring wp-settings.php
	*
	* Alternatively, you can add this to your child theme's functions.php, or into its own (mu) plugin.
	*/
	if (function_exists('add_filter')) {
	add_filter('addh_options', function($options) {
	// Another plugin handles the Expires and Cache-Control headers, so disable them in the Add Headers plugin.
	$options['add_expires_header'] = false;
	$options['add_cache_control_header'] = false;

	return $options;
	});
	}