From e41b226529b640a05d83883ce217efd43e8ee8ce Mon Sep 17 00:00:00 2001
From: Jeppe B <2jepp9350@gmail.com>
Date: Mon, 1 Jun 2026 23:19:04 +0200
Subject: [PATCH] Deny web access to replication bootstrap snapshots

---
 services/caddy/Caddyfile         | 4 ++++
 services/caddy/Caddyfile-staging | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/services/caddy/Caddyfile b/services/caddy/Caddyfile
index 697dfa57..97b40e60 100644
--- a/services/caddy/Caddyfile
+++ b/services/caddy/Caddyfile
@@ -10,6 +10,10 @@
     # CORS is handled at the edge by Traefik's headers middleware.
     # Do not set or strip Access-Control-* headers here to avoid conflicts.
 
+    # Replication bootstrap snapshots contain sensitive failover credentials.
+    @replication_bootstrap path /storage/replication-bootstrap.json /storage/replication-bootstrap-*
+    respond @replication_bootstrap 404
+
     # PHP handling via FastCGI to php-fpm pool
     php_fastcgi php1:9000 php2:9000 php3:9000 php4:9000 php5:9000
 
diff --git a/services/caddy/Caddyfile-staging b/services/caddy/Caddyfile-staging
index 4989804b..201ca2fb 100644
--- a/services/caddy/Caddyfile-staging
+++ b/services/caddy/Caddyfile-staging
@@ -10,6 +10,10 @@
     # CORS is handled at the edge by Traefik's headers middleware.
     # Do not set or strip Access-Control-* headers here to avoid conflicts.
 
+    # Replication bootstrap snapshots contain sensitive failover credentials.
+    @replication_bootstrap path /storage/replication-bootstrap.json /storage/replication-bootstrap-*
+    respond @replication_bootstrap 404
+
     # PHP handling via FastCGI to php-fpm pool
     php_fastcgi php-staging:9000