Upgrade to Caddy using trajano/google-fonts-proxy-docker

tgalopin · tgalopin · commit 9b1b17ec4f69 · 2025-10-28T15:15:47.000+01:00
diff --git a/.github/workflows/docker-publish.yaml b/.github/workflows/docker-publish.yaml
@@ -12,10 +12,10 @@ jobs:
             - uses: actions/checkout@master
 
             - name: Build and publish
-              uses: elgohr/Publish-Docker-Github-Action@master
+              uses: elgohr/Publish-Docker-Github-Action@v5
               with:
-                  name: citipo/docker-google-fonts-proxy/alpine
+                  name: citipo/docker-google-fonts-proxy
                   username: citipo
                   password: ${{ secrets.GITHUB_TOKEN }}
-                  registry: docker.pkg.github.com
+                  registry: ghcr.io
                   dockerfile: Dockerfile
diff --git a/Caddyfile b/Caddyfile
@@ -0,0 +1,104 @@
+{
+	admin off
+	order replace before encode
+	order replace after vars
+	order replace after copy_response
+	cache {
+	    # Force cache 30 days
+		ttl 2592000s
+		mode bypass
+		default_cache_control public, max-age=2592000
+		key {
+			disable_scheme
+		}
+		nuts {
+			configuration {
+				Dir /data/nuts
+			}
+		}
+	}
+}
+
+:80
+@tracingEnabled expression {env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT} != ""
+
+@resources {
+	method GET HEAD
+	path /css /css2 /icon
+}
+handle @resources {
+	cache
+	handle @tracingEnabled
+	tracing {
+		span {path}
+	}
+
+	reverse_proxy @resources https://fonts.googleapis.com {
+		header_up Host {upstream_hostport}
+		header_up -X-Forwarded-For
+		header_up -X-Forwarded-Host
+		header_up -X-Forwarded-Proto
+		header_up Accept-Encoding identity
+		header_down -Cache-Control
+		header_down -Report-To
+		header_down -Content-Security-Policy-Report-Only
+		header_down -Cross-Origin-Opener-Policy
+		header_down -Cross-Origin-Resource-Policy
+		header_down -Link
+	}
+
+	replace stream {
+		"https://fonts.gstatic.com/s" "//{env.FONTS_HOST}/s"
+	}
+}
+
+@static {
+	method GET HEAD
+	path /s/*
+}
+handle @static {
+	cache
+	handle @tracingEnabled
+	tracing {
+		span {path}
+	}
+
+	reverse_proxy https://fonts.gstatic.com {
+		header_up Host {upstream_hostport}
+		header_up -X-Forwarded-For
+		header_up -X-Forwarded-Host
+		header_up -X-Forwarded-Proto
+		header_up Accept-Encoding identity
+		header_down -Cache-Control
+		header_down -Report-To
+		header_down -Content-Security-Policy-Report-Only
+		header_down -Cross-Origin-Opener-Policy
+		header_down -Cross-Origin-Resource-Policy
+		header_down -Link
+	}
+}
+
+# Debug endpoint, to check if any private information gets leaked
+@debug {
+	method GET
+	path /debug
+}
+handle @debug {
+	rewrite * /get
+	reverse_proxy https://httpbin.org {
+		header_up Host {upstream_hostport}
+		header_up -X-Forwarded-For
+		header_up -X-Forwarded-Host
+		header_up -X-Forwarded-Proto
+		header_up Accept-Encoding identity
+		header_down -Cache-Control
+		header_down -Report-To
+		header_down -Content-Security-Policy-Report-Only
+		header_down -Cross-Origin-Opener-Policy
+		header_down -Cross-Origin-Resource-Policy
+		header_down -Link
+	}
+}
+
+respond / 204
+respond 404
diff --git a/Dockerfile b/Dockerfile
@@ -1,46 +1,11 @@
-FROM nginx:1.21-alpine AS builder
-
-ENV SUBS_VERSION 1.1.15
-ENV FONTS_HOST 'http://localhost'
-
-RUN apk add --no-cache --virtual .build-deps \
-        git \
-        gcc \
-        libc-dev \
-        make \
-        openssl-dev \
-        pcre2-dev \
-        zlib-dev \
-        linux-headers \
-        libxslt-dev \
-        gd-dev \
-        geoip-dev \
-        perl-dev \
-        libedit-dev \
-        bash \
-        alpine-sdk \
-        findutils
-
-RUN wget "http://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz" -O nginx.tar.gz
-RUN mkdir /tmp/src && CONFARGS=$(nginx -V 2>&1 | sed -n -e 's/^.*arguments: //p') tar -zxC /tmp/src -f nginx.tar.gz
-
-RUN git clone git://github.com/yaoweibin/ngx_http_substitutions_filter_module.git
-
-RUN SUBSDIR="$(pwd)/ngx_http_substitutions_filter_module" && \
-    cd /tmp/src/nginx-$NGINX_VERSION && \
-    ./configure --with-compat $CONFARGS --add-dynamic-module=$SUBSDIR && \
-    make && \
-    make install
-
-FROM nginx:1.21-alpine
-
-# Extract the dynamic module NCHAN from the builder image
-COPY --from=builder /usr/local/nginx/modules/ngx_http_subs_filter_module.so /usr/local/nginx/modules/ngx_http_subs_filter_module.so
-
-COPY ./conf/nginx.conf.template /etc/nginx/nginx.conf.template
-COPY ./docker-entrypoint.sh /
-RUN chmod a+x /docker-entrypoint.sh
-
-ENTRYPOINT ["/docker-entrypoint.sh"]
-
-CMD ["nginx", "-g", "daemon off;"]
+FROM caddy:builder AS builder
+RUN xcaddy build \
+    --with github.com/caddyserver/replace-response \
+    --with github.com/caddyserver/cache-handler \
+    --with github.com/darkweak/storages/nuts/caddy
+
+FROM busybox:1.37.0-uclibc
+COPY --from=builder /usr/bin/caddy /usr/bin/caddy
+COPY Caddyfile /etc/caddy/Caddyfile
+HEALTHCHECK --start-period=10s --start-interval=1s CMD wget -q --spider http://localhost/ || exit 1
+CMD [ "/usr/bin/caddy", "run", "--config", "/etc/caddy/Caddyfile" ]
diff --git a/README.md b/README.md
@@ -5,18 +5,20 @@ receiving visits from European Union residents.
 
 These new restrictions make it more illegal to use Google Fonts directly. This proxy is a plug-and-play
 replacement for Google Fonts that can be hosted on a custom domain to proxy Google Fonts and thus comply
-with GDPR (as no personal data will be transfered to Google Fonts).
+with GDPR (as no personal data will be transferred to Google Fonts).
 
 This image only relies on nginx and its substitution module: it's extremely fast, privacy friendly and 
 production ready.
 
+> The latest version is based on https://github.com/trajano/google-fonts-proxy-docker.
+
 ## Usage
 
 Once setup (for instance at Citipo we run an instance on https://fonts.citipo.com), all requests done to 
 the configured URL will be forwarded to Google Fonts with the same exact URL path and CSS responses
 will be altered on-the-fly to change fonts files reference to use your own domain. 
 
-**This forwarding will be done fully anonymously so that the client IP and personnal data won't ever 
+**This forwarding will be done fully anonymously so that the client IP and personal data won't ever 
 be transmitted to Google.**
 
 Once deployed, you can use the service by directly replacing the Google Fonts URL with your own:
@@ -27,27 +29,26 @@ Once deployed, you can use the service by directly replacing the Google Fonts UR
 <link href="https://fonts.citipo.com/css2?family=Assistant:ital,wght@0,400;0,700;0,800;1,400;1,700" rel="stylesheet" crossorigin="anonymous" />
 ```
 
-> In compliance to Google Fonts Terms of Service, this proxy doesn't cache the fonts locally, it only transfers
-> the requests (https://github.com/google/fonts/issues/1637).
-
 ## Setup
 
 With docker-compose:
 
 ```yaml
-version: '3'
-
 services:
     fonts:
-        image: docker.pkg.github.com/citipo/docker-google-fonts-proxy/alpine
+        image: ghcr.io/citipo/docker-google-fonts-proxy
         ports:
             # You can use a proxy (like https://github.com/nginx-proxy/nginx-proxy) 
             # to provide SSL
             - '80:80'
         environment:
             # The host you use for fonts: references to Google Fonts 
             # will be replaced to this host in CSS files
-            - FONTS_HOST=fonts.citipo.com
+            FONTS_HOST: fonts.citipo.com
+        volumes:
+            # The fonts and CSS files will be cached locally in this directory for 30 days
+            # in order to avoid sending too many requests to Google Fonts
+            - './storage:/data/nuts'
 ```
 
 With Docker CLI:
@@ -56,17 +57,17 @@ With Docker CLI:
 docker run -d \ 
     -p 80:80 \
     -e FONTS_HOST=fonts.citipo.com \
-    docker.pkg.github.com/citipo/docker-google-fonts-proxy/alpine
+    ghcr.io/citipo/docker-google-fonts-proxy
 ```
 
 ## For developers: what to tell you Data Protection Officer?
 
-Your Data Protection Officer (the person responsible of GDPR in your company) may be curious about the details
+Your Data Protection Officer (the person responsible for GDPR in your company) may be curious about the details
 of this tool, especially given the amount of media coverage the latest Google Fonts GDPR issues had.
 
 To answer their questions, you can explain that this tool *anonymizes data* (in the GDPR meaning): it transforms
 personal, indirectly identifiable data into fully anonymous requests towards Google. As long as you host this
-service in your own infrastructure, no personal data is ever transfered to Google (or any other intermediate).
+service in your own infrastructure, no personal data is ever transferred to Google (or any other intermediate).
 
-Data anonymization (which is different from pseudonymization) ensures that the data transfered to Google isn't
+Data anonymization (which is different from pseudonymization) ensures that the data transferred to Google isn't
 covered by GDPR, thus not being a compliance issue. 
diff --git a/compose.yaml b/compose.yaml
@@ -0,0 +1,7 @@
+services:
+    fonts:
+        build: .
+        ports:
+            - '4000:80'
+        environment:
+            FONTS_HOST: localhost:4000
diff --git a/conf/nginx.conf.template b/conf/nginx.conf.template
diff --git a/docker-entrypoint.sh b/docker-entrypoint.sh
diff --git a/fmt.sh b/fmt.sh
@@ -0,0 +1,2 @@
+#!/bin/bash
+MSYS_NO_PATHCONV=1 command docker run -v $(pwd):/mnt caddy caddy fmt --overwrite /mnt/Caddyfile
diff --git a/test.sh b/test.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+set -ex
+image_name=$(docker build . -q)
+MSYS_NO_PATHCONV=1 docker run -v $(pwd):/mnt $image_name caddy validate --config /mnt/Caddyfile
+MSYS_NO_PATHCONV=1 docker run -v $(pwd):/mnt $image_name caddy fmt --overwrite /mnt/Caddyfile
+PORT=$RANDOM
+container_name=$(docker run --rm -q -p $PORT:80 --env "STATIC_URL=http://localhost:$PORT/s"  -d $image_name)
+while [ "$(docker inspect --format='{{.State.Health.Status}}' $container_name)" != "healthy" ]; do
+  sleep 1
+done
+curl -v 'localhost:'$PORT'/'
+curl -v 'localhost:'$PORT'/css?family=Roboto:300,400,400i,700,700i&display=swap'
+curl -v 'localhost:'$PORT'/debug'

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+#!/bin/bash`
	`2`	`+MSYS_NO_PATHCONV=1 command docker run -v $(pwd):/mnt caddy caddy fmt --overwrite /mnt/Caddyfile`