Monorepo for Aesthetic.Computer
aesthetic.computer
lith/Caddyfile: actually let Kubo own the ipfs CORS header
The "restore Caddy-side CORS" commit reintroduced the "*, *" dupe. Kubo IS
emitting Access-Control-Allow-Origin: * after all — the earlier test that
showed zero headers was a Cloudflare-cached response from the immediately
prior broken deploy. Drop Caddy's header directive and let Kubo own it.
If the browser still sees "*, *" after a deploy, bust the Cloudflare cache
before debugging further.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
+3
-5
+3
-5
lith/Caddyfile
+3
-5
lith/Caddyfile
···
133
133
}
134
134
135
135
# --- ipfs.aesthetic.computer (self-hosted IPFS gateway) ---
136
-
# Kubo doesn't emit Access-Control-Allow-Origin on its own, so Caddy sets it.
137
-
# The earlier "*, *" dupe came from Cloudflare (or a WAF rule) adding its
138
-
# own header on top of Caddy's — if that comes back, disable the CF
139
-
# Transform Rule rather than stripping here.
136
+
# Kubo emits Access-Control-Allow-Origin: * on its own. An earlier Caddy
137
+
# `header` directive was stacking a second copy, producing "*, *" that
138
+
# browsers reject. Let Kubo own the header, Caddy just proxies.
140
139
@ipfs host ipfs.aesthetic.computer
141
140
handle @ipfs {
142
-
header Access-Control-Allow-Origin *
143
141
reverse_proxy localhost:8090
144
142
}
145
143