Caddyfile

# Global caddy config options must be first
{
    admin off
    auto_https off
}

# Bind to port 80
:80

# Serve static files
file_server

# Fallback to index.html for everything but assets
@html {
  not path *.js *.css *.png *.svg *.pdf *.eot *.ttf *.woff *.woff2 *.webmanifest

  file index.html
}

handle_errors {
  header Cache-Control no-store
}

rewrite @html {http.matchers.file.relative}

# Don't cache index.html and set CSP
header @html Cache-Control no-store
header @html Content-Security-Policy "
  default-src 'self';
  connect-src 'self'
    bitclout.com:*
    api.bitclout.com
    bithunt.bitclout.com
    pulse.bitclout.com
    api.bitpop.dev
    localhost:*
    explorer.bitclout.com:*
    https://api.blockchain.com/ticker
    https://api.blockchain.com/mempool/fees
    https://ka-f.fontawesome.com/
    bitcoinfees.earn.com
    api.blockcypher.com
    amp.bitclout.com api.bitclout.green api.bitclout.blue
    api.bitclout.navy
    api.testwyre.com
    api.sendwyre.com;
  script-src 'self'
    https://kit.fontawesome.com/070ca4195b.js
    https://ka-f.fontawesome.com/;
  style-src 'self'
    'unsafe-inline'
    https://fonts.googleapis.com
    https://cdn.jsdelivr.net/npm/bootstrap@4.6.0/dist/css/bootstrap.min.css;
  img-src 'self' data: i.imgur.com images.bitclout.com quickchart.io;
  font-src 'self'
    https://fonts.googleapis.com
    https://fonts.gstatic.com
    https://ka-f.fontawesome.com;
  frame-src 'self'
    localhost:*
    identity.bitclout.com
    identity.bitclout.blue
    identity.bitclout.green
    https://geo.captcha-delivery.com
    https://www.youtube.com
    https://youtube.com
    https://player.vimeo.com
    https://www.tiktok.com
    https://giphy.com
    https://open.spotify.com
    https://w.soundcloud.com
    pay.testwyre.com
    pay.sendwyre.com;
  frame-ancestor 'self';"