game-kit/gamehall/gamehall.caddy

# Kestrel's Hall, the front door of the family: a static page, no server.
gamehall.kestrelsnest.social, gamehall.159.203.115.252.sslip.io {
	# The hall-wide notice (hall-announce on the host): one file, served by every game's site.
	handle_path /hall/* {
		root * /var/lib/hall
		header Cache-Control "no-store"
		file_server
	}

	root * /opt/gamehall
	encode gzip zstd

	header {
		Strict-Transport-Security "max-age=31536000"
		X-Content-Type-Options "nosniff"
		X-Frame-Options "DENY"
		# A card followed into a game says it came from the hall, and nothing more.
		Referrer-Policy "strict-origin"
		# Revalidated on every load, so a deploy shows up at once.
		Cache-Control "no-cache"
	}

	log {
		output file /var/lib/caddy/gamehall-access.log {
			roll_size 10MiB
			roll_keep 30
		}
	}

	file_server
}