caddy: reject access to hidden file and lug admin API

[skyzh]

:80 {
	@hidden {
		path */.*
	}
	encode gzip
	respond @hidden 403
	reverse_proxy /lug/* siyuan-lug:7001 {
		header_down Access-Control-Allow-Origin *
		header_down Access-Control-Request-Method GET
	}
	# TODO: block access to lug admin API /lug/v1/admin/*
	file_server /ubuntu/* browse {
		root /srv
	}
	file_server /* {
		root /dists
	}
}

[BugenZhao]

Seems like we need to add @hidden fields to all http-only sites as well?

[skyzh]

Seems like we need to add @hidden fields to all http-only sites as well?

Yes

[BugenZhao]

Working on it in #32.