A compact, non-exhaustive reference for the values that appear across the notes. Prefer the linked source for the authoritative rule; these tables are memory aids.
HTTP status and cache freshness
| Code | Meaning | Used for |
|---|---|---|
| 200 OK | The resource exists and the representation is returned | baseline for a healthy route |
| 301 Moved Permanently | The URI changed permanently | deciding between the old and new URI in logs |
| 308 Permanent Redirect | Non-GET methods keep their method across the redirect | the redirects note |
| 206 Partial Content | A range request was honored | the range-requests note |
| 304 / 412 | Validators drive conditional requests | the conditional-requests note |
| 404 | Not found | the handle_errors page in the Caddyfile |
| 500 / 502 / 503 | Origin or proxy failure | release smoke tests and restart loops |
| Directive or header | Effect |
|---|---|
Cache-Control: public, max-age=31536000, immutable | long lease for content-hashed assets |
Cache-Control: private, max-age=300 plus ETag | short freshness with cheap revalidation for HTML |
Cache-Control: no-store | never store; for session-bound responses |
ETag / If-None-Match leading to 304 | strong validation without re-downloading the body |
Last-Modified / If-Modified-Since | weaker timestamp validation when no ETag exists |
See also: cache headers, conditional requests, compression, method semantics.
Security headers at the public edge
| Header | A short version of the policy |
|---|---|
Content-Security-Policy | default-src 'self'; script-src 'none' keeps the page script-free |
Strict-Transport-Security | max-age=31536000; includeSubDomains forces HTTPS for a year |
X-Content-Type-Options | nosniff stops MIME-type guessing |
X-Frame-Options | DENY prevents framing |
Referrer-Policy | strict-origin-when-cross-origin limits referrers |
Set-Cookie | Secure; HttpOnly; SameSite=Lax narrows cookie scope by default |
See also: security headers, HSTS rollout, cookie scope, content type.
DNS and TLS checks
| Record or check | What it answers |
|---|---|
A / AAAA | which address the name resolves to |
CNAME | which canonical name the alias follows |
CAA | which certificate issuers are authorized |
TTL | how long resolvers may cache the answer; lower it before a change window |
# where a name resolves, and for how long
dig +nocmd +noall +answer +ttl example.com A
# print the served chain and expiry without changing anything
openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null 2>/dev/null | openssl x509 -noout -dates -issuer
See also: CAA records, DNS change window, certificate chain, expiry check.
Caddy and release smoke tests
| Step | Check |
|---|---|
| Build | one complete artifact directory per release |
| Manifest | every published byte named with a checksum |
| Publish | switch the served directory only after verification; keep the previous one |
| Edge | request a page, a file, and a missing path; compare status codes and content types |
| TLS | test the HTTP-to-HTTPS redirect and the certificate name on the public hostname |
# per file
sha256sum <file>
# plain-text checks from the operator kit
check-http-headers.sh https://www.xbcatm.com/
check-tls-expiry.sh www.xbcatm.com 30
See also: static root, release checklist, read the edge, atomic switch, release manifest, resources.
Sources
- RFC 9110 — HTTP Semantics, status code definitions and ranges, checked 2026-08-24.
- MDN: HTTP response status codes, complete status list, checked 2026-08-24.
- RFC 9111: HTTP Caching, cache directives and validation rules, checked 2026-09-05.
- MDN: Content Security Policy guide, CSP directive names and syntax, checked 2026-09-05.
- MDN:
Strict-Transport-Security, HSTS directives and deployment cautions, checked 2026-09-05. - RFC 8659 — DNS Certification Authority Authorization, CAA lookup and property semantics, checked 2026-09-05.
- Caddy
file_serverdirective, file serving, root, and index defaults, checked 2026-09-05. - OpenSSL
s_clientdocumentation, SNI and certificate inspection options, checked 2026-09-05.