jaredandClaude Opus 5.5
afdbf6eaec
X-Frame-Options DENY and CSP frame-ancestors 'none', inside location / (it has its own add_header, so server-level headers aren't inherited). Live on proxy host 58 since 2026-10-11. Refs #12 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
41 lines
1.6 KiB
Plaintext
41 lines
1.6 KiB
Plaintext
# Nginx Proxy Manager → Proxy Host dev.lotusguild.org → Advanced tab.
|
|
# Target: http://10.10.10.58:7681, Websockets Support ON, wildcard *.lotusguild.org cert, Force SSL.
|
|
#
|
|
# Replace __DEVDESK_BASIC__ with the base64 of the credential in /etc/devdesk/secret.env:
|
|
# . /etc/devdesk/secret.env && printf '%s' "$DEVDESK_CREDENTIAL" | base64 -w0
|
|
# ttyd rejects (401) every request that does not carry it, so only traffic that
|
|
# passed Authelia here can reach the terminal.
|
|
|
|
include /snippets/authelia-location.conf;
|
|
|
|
location / {
|
|
# Headers go here, not at server level: a location with its own add_header
|
|
# (HSTS) doesn't inherit the server's.
|
|
add_header Strict-Transport-Security $hsts_header always;
|
|
# No other site may frame the terminal (clickjacking).
|
|
add_header X-Frame-Options "DENY" always;
|
|
add_header Content-Security-Policy "frame-ancestors 'none'" always;
|
|
|
|
auth_request /authelia;
|
|
auth_request_set $user $upstream_http_remote_user;
|
|
auth_request_set $groups $upstream_http_remote_groups;
|
|
auth_request_set $name $upstream_http_remote_name;
|
|
auth_request_set $email $upstream_http_remote_email;
|
|
|
|
proxy_set_header Remote-User $user;
|
|
proxy_set_header Remote-Groups $groups;
|
|
proxy_set_header Remote-Name $name;
|
|
proxy_set_header Remote-Email $email;
|
|
|
|
error_page 401 =302 https://auth.lotusguild.org/?rd=$scheme://$http_host$request_uri;
|
|
|
|
proxy_set_header Authorization "Basic __DEVDESK_BASIC__";
|
|
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_http_version 1.1;
|
|
proxy_buffering off;
|
|
|
|
include /etc/nginx/conf.d/include/proxy.conf;
|
|
}
|