I am reviewing a CyberPanel/OpenLiteSpeed deployment pattern for a browser-based application that accepts room photos, generates interior concepts, and then lets users compare design directions. The current public reference is AI Interior Design. The public pages can be cached, but uploaded room images and generation responses must never leak between visitors.
For people running a similar mixed static/dynamic workload, what would you recommend for the following?
- Cache exclusions: Is it better to exclude all upload, generation, account and result routes in the OpenLiteSpeed vhost rules, or to rely on application response headers such as
Cache-Control: private, no-store? Should both layers be configured as defense in depth? - Upload handling: Which CyberPanel/OpenLiteSpeed settings should be adjusted for moderate image uploads while keeping request limits conservative? I also want temporary source files removed after the generation job finishes.
- Headers and isolation: Beyond CSP, Referrer-Policy, Permissions-Policy and HSTS, are there CyberPanel-specific defaults that should be changed for an application processing user images?
- Logging: Can access/error logs be configured to avoid recording query strings, generated asset tokens or temporary filenames while still retaining enough information for abuse and performance debugging?
- Staging: Is a separate vhost with basic authentication and robots blocking the cleanest way to test model/API changes before moving them to production?
My tentative plan is to cache only versioned static assets and anonymous marketing pages, disable caching for any request carrying a session or result token, store uploads outside the public document root, and run scheduled cleanup for temporary files. I would appreciate corrections from anyone operating image-processing or AI applications behind CyberPanel.