Caddy Config

{
	# ترتیب اجرای هندلرها (برای اینکه بلاک‌ها قبل از پروکسی انجام شوند)
	order abort before respond
	order rate_limit before respond
	order respond before reverse_proxy
}

# ───────────────────── Snippet: بلاک اسکنرها و مسیرهای خطرناک ─────────────────────
(block_exploits) {
	# 1) فایل‌های مخفی و حساس
	@dotfiles {
		path /.env
		path /.git
		path /.git/*
		path /.gitignore
		path /.htaccess
		path /.htpasswd
		path /.DS_Store
	}
	respond @dotfiles 403

	# 2) اگر PHP لازم نداری، کل *.php را ببند (در صورت نیاز، این بخش را حذف کن)
	@any_php {
		expression `{path} =~ '(?i)\\.php($|\\?)'`
	}
	abort @any_php

	# 3) هر مسیر شامل fckeditor/fck/ckeditor/ckfinder
	@fckeditor_all {
		expression `{path} =~ '(?i).*/(fckeditor|fck|ckeditor|ckfinder)/.*'`
	}
	abort @fckeditor_all

	# 4) الگوی filemanager/browser + (connector|connectors|upload) با پسوندهای حساس
	@fileman_conns {
		expression `{path} =~ '(?i).*/(filemanager|browser)/.*/(connector|connectors|upload)/.*\\.(php|asp|aspx|jsp|cgi)$'`
	}
	abort @fileman_conns

	# 5) مسیرهای دقیقی که در لاگ دیده‌ای
	@known_exploits {
		path /sites/all/modules/fckeditor/fckeditor/editor/filemanager/browser/default/connectors/php/connector.php
		path /libraries/fckeditor/editor/filemanager/browser/default/connectors/php/connector.php
		path /administrator/fckeditor/editor/filemanager/browser/default/connectors/php/connector.php
		path /administrator/FCKeditor/editor/filemanager/browser/default/connectors/php/connector.php
		path /plugins/fckeditor/editor/filemanager/browser/default/connectors/php/connector.php
		path /scripts/fckeditor/editor/filemanager/upload/php/upload.php
		path /libraries/FCKeditor/editor/filemanager/browser/default/connectors/php/connector.php
		path /scripts/FCKeditor/editor/filemanager/upload/php/upload.php
		path /administrator/FCKeditor/editor/filemanager/upload/php/upload.php
		path /plugins/FCKeditor/editor/filemanager/browser/default/connectors/php/connector.php
		path /javascript/FCKeditor/editor/filemanager/browser/default/connectors/php/connector.php
		path /fck/editor/filemanager/upload/php/upload.php
		path /plugins/FCKeditor/editor/filemanager/upload/php/upload.php
		path /javascript/FCKeditor/editor/filemanager/upload/php/upload.php
		path /sites/all/modules/fckeditor/fckeditor/editor/filemanager/upload/php/upload.php
		path /javascript/fckeditor/editor/filemanager/browser/default/connectors/php/connector.php
		path /fck/editor/filemanager/browser/default/connectors/php/connector.php
		path /administrator/fckeditor/editor/filemanager/upload/php/upload.php
		path /scripts/fckeditor/editor/filemanager/browser/default/connectors/php/connector.php
		path /scripts/FCKeditor/editor/filemanager/browser/default/connectors/php/connector.php
		path /plugins/fckeditor/editor/filemanager/upload/php/upload.php
		path /javascript/fckeditor/editor/filemanager/upload/php/upload.php
		path /ckeditor/filemanager/upload/php/upload.php
		path /libraries/FCKeditor/editor/filemanager/upload/php/upload.php
		path /libraries/fckeditor/editor/filemanager/upload/php/upload.php
		path /plugins/fckeditor/FCKeditor/editor/filemanager/browser/default/connectors/php/connector.php
		path /ckeditor/filemanager/browser/default/connectors/php/connector.php
		path /plugins/fckeditor/FCKeditor/editor/filemanager/upload/php/upload.php
	}
	abort @known_exploits

	# 6) اسکن‌های رایج دیگر
	@wp_scans {
		path /wp-login.php
		path /xmlrpc.php
		path /wp-admin/*
		path /wp-includes/*
		path /wp-content/*
	}
	abort @wp_scans

	@pma {
		expression `{path} =~ '(?i)phpmyadmin'`
	}
	abort @pma
}

# ───────────────────── Snippet: تنظیمات مشترک ─────────────────────
(common) {
	# بلاک‌ها قبل از هر چیز
	import block_exploits

	# فشرده‌سازی
	encode zstd gzip

	# Rate limit: بیش از 50 درخواست در 1 ثانیه از یک IP
	rate_limit {
		zone offenders {
			key    {remote_ip}
			events 50
			window 1s
		}
	}

	# صفحه 429 ساده و سبک
	handle_errors {
		@rate_limited {
			expression `{http.error.status_code} == 429`
		}
		header @rate_limited Retry-After "60"
		respond @rate_limited 429 "Too many requests. Please try again later."
	}
}

# ─