hernani/koopa-admin-log
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ops/dossiers-ngi: Caddy Vary Cookie + no-cache for edition-pure CSS

Browse source
This commit is contained in:
Hernâni Marques 2026-09-30 16:07:49 +02:00
parent 84623b7c9a
commit 686a9fb906
No known key found for this signature in database
2 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
scripts/dossiers-ngi/README.md
View file

@ -103,6 +103,8 @@ Each name links to `/_cascade/use/<edition>` (cookie + 302 `/`). Caddy map:
Also serve `/cascade/*` from the site www root (path stubs). Live Caddy must not use a trailing `~.* flask` catch-all. Also serve `/cascade/*` from the site www root (path stubs). Live Caddy must not use a trailing `~.* flask` catch-all.
Edition purity: responses send `Vary: Cookie` and `Cache-Control: private, no-cache` so `/static/css/style.css` (same path, different bodies per edition) cannot stick the green design CSS onto `main` after a views visit.
so new branches need no Caddy edit — only an `editions/<slug>/` tree. so new branches need no Caddy edit — only an `editions/<slug>/` tree.
```bash ```bash

8
scripts/dossiers-ngi/caddy-dossiers-ngi.snippet
View file

@ -10,26 +10,34 @@
# Site-block body (no outer braces): # Site-block body (no outer braces):
header Alt-Svc "clear" header Alt-Svc "clear"
# Cookie selects editions/<slug>/; same paths (/static/css/style.css) must not
# share one browser/CDN cache entry across editions (main has no green CSS).
header Vary "Cookie"
header Cache-Control "private, no-cache"
@use path_regexp use ^/_cascade/use/([A-Za-z0-9_-]+)/?$ @use path_regexp use ^/_cascade/use/([A-Za-z0-9_-]+)/?$
handle @use { handle @use {
header Set-Cookie "tdpd_edition={re.use.1}; Path=/; Max-Age=31536000; SameSite=Lax" header Set-Cookie "tdpd_edition={re.use.1}; Path=/; Max-Age=31536000; SameSite=Lax"
header Cache-Control "private, no-store"
redir * / 302 redir * / 302
} }
handle /_cascade/* { handle /_cascade/* {
root * /var/www/monitoring-sites/dossiers.ngi.hacktivism.ch root * /var/www/monitoring-sites/dossiers.ngi.hacktivism.ch
header Cache-Control "private, no-cache"
file_server file_server
} }
# Path-root cascade stubs (feat-website-views, …) live under sites/…/cascade/ # Path-root cascade stubs (feat-website-views, …) live under sites/…/cascade/
# and must not fall through to editions/{cookie}/ (that yields 404). # and must not fall through to editions/{cookie}/ (that yields 404).
handle /cascade/* { handle /cascade/* {
root * /var/www/monitoring-sites/dossiers.ngi.hacktivism.ch root * /var/www/monitoring-sites/dossiers.ngi.hacktivism.ch
header Cache-Control "private, no-cache"
file_server file_server
try_files {path} {path}/ {path}/index.html try_files {path} {path}/ {path}/index.html
} }
handle /branch-status.json { handle /branch-status.json {
root * /var/www/monitoring-sites/dossiers.ngi.hacktivism.ch root * /var/www/monitoring-sites/dossiers.ngi.hacktivism.ch
header Cache-Control "private, no-cache"
file_server file_server
} }