diff --git a/ansible/templates/Caddyfile.j2 b/ansible/templates/Caddyfile.j2
index 658c30d..3b57560 100644
--- a/ansible/templates/Caddyfile.j2
+++ b/ansible/templates/Caddyfile.j2
@@ -13,6 +13,19 @@
{{ pingarthur_domain }} {
tls /etc/caddy/certs/{{ pingarthur_domain }}.crt /etc/caddy/certs/{{ pingarthur_domain }}.key
+ # Security headers — matches divepool.social posture. HSTS preload-eligible,
+ # no framing, no MIME sniffing, conservative referrer policy, no ambient
+ # access to camera/mic/geo (defense-in-depth even though pingarthur has no
+ # UI). -Server hides Caddy's banner.
+ header {
+ Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
+ X-Frame-Options "DENY"
+ X-Content-Type-Options "nosniff"
+ Referrer-Policy "strict-origin-when-cross-origin"
+ Permissions-Policy "camera=(), microphone=(), geolocation=()"
+ -Server
+ }
+
# Public API endpoints + supervisor health probe + homepage.
handle /api/v1/* {
reverse_proxy 127.0.0.1:8080
diff --git a/homepage.go b/homepage.go
index 14400ee..ea7fe36 100644
--- a/homepage.go
+++ b/homepage.go
@@ -27,7 +27,7 @@ const homepageHTML = `
-
+
@@ -42,7 +42,7 @@ const homepageHTML = `
"applicationCategory": "DeveloperApplication",
"operatingSystem": "Any",
"offers": {"@type": "Offer", "price": "0", "priceCurrency": "USD"},
- "creator": {"@type": "Person", "name": "Jasper Rädisch", "url": "https://raedisch.net/"},
+ "author": {"@type": "Person", "name": "Jasper Rädisch", "url": "https://raedisch.net/"},
"sameAs": [
"https://bsky.app/profile/pingarthur.com",
"https://tangled.org/divepool.social/pingarthur"