Mautic + Caddy - from NGINX conf syntax

[perroud (Eduardo Perroud)]

Before to test, I have some attempts to translate NGINX conf to Caddyfile syntax into Caddyfile. Below, the NGINX and Caddy syntax, respectively:

1. path /app

location ~ /app/ {
	deny all;
}

Attempt 01

rewrite {
	if {path} starts_with app
	status 403
}

Attempt 02

# Is it better than rewrite above?
status 403 {
	/app
}

---

2. path /Assets inside /app

location ~ /app/bundles/.*/Assets/ {
	allow all;
	access_log off;
}

rewrite {
	if {path} start_with app
	if {path} has Assets
	status 200
}

---

3. All PHP files inside themes path

location ~* ^/themes/(.*)\.php {
	deny all;
}

rewrite {
	ext .php
	if {path} match /themes
	# match or has?
	status 403
}

---

4. Prevent access the following files extensions

location ~* /(.*)\.(?:markdown|md|twig|yaml|yml|ht|htaccess|ini)$ {
	deny all;
	access_log off;
	log_not_found off;
}

rewrite {
	ext .markdown .md .twig .yaml .yml .ht .htaccess .ini
	status 403
}

---

5. Prevent access for some js/json specific files

location ~* (Gruntfile|package|composer)\.(js|json)$ {
	deny all;
	access_log off;
	log_not_found off;
}

rewrite {
	ext .js .json
	if {file} match (Gruntfile|package|composer)
	status 403
}

---

I am not sure about to handle with ~ and/or ~* from NGINX. Some considerations? Tips? Any appointment will be appreciated. The intention is really understand the better way. For now, I have many tabs from Caddy Docs opened. I really want to learn

=> Note:
About Mautic rewrite, I’m using the following only:

rewrite {
	to {path} {path}/ /index.php/{query}
}

Works like a charm. The /index.php/ removed.

Thank you very much.

[Whitestrake (Matthew Fay)]

@perroud

Attempt 01

rewrite {
	if {path} starts_with app
	status 403
}

status is not a subdirective of rewrite. I believe {path} also always starts with /, too, so the if condition there might never actually be met. Your Attempt 02 should function like the nginx config in this case.

@perroud

rewrite {
	if {path} start_with app
	if {path} has Assets
	status 200
}

Like before, status is not a subdirective of rewrite, but also keep this in mind for the real status directive (emphasis mine):

status writes a status code to the response. It does not write a response body.

—https://caddyserver.com/docs/status

So you’ll be sending empty Status 200 responses for these paths - likely not desirable behaviour.

@perroud

rewrite {
	ext .php
	if {path} match /themes
	# match or has?
	status 403
}

match is for regex. You could simply match /themes/(.*)\.php, or you could use starts_with /themes/ with ext .php, for example.

• match = a matches b, where b is a regular expression

—https://caddyserver.com/docs/rewrite

@perroud

rewrite {
	ext .markdown .md .twig .yaml .yml .ht .htaccess .ini
	status 403
}

As explained above, this won’t work. rewrite operates before status does, though, so you can rewrite to some specific path unused by your app and then status 403 that path, e.g.

rewrite {
  if {foo} cond bar
  to /status_403_forbidden
}
status 403 /status_403_forbidden

@perroud

5. Prevent access for some js/json specific files

Again, match is a regex, so you could just use match (Gruntfile|package|composer)\.(js|json)$ if you’re going to use regex. Alternately, you can use if_op or to check (probably a smidge faster):

rewrite {
  if_op or
  if {file} has Gruntfile
  if {file} has package
  if {file} has composer
  ext .js .json
  to /status_403_forbidden
}