6 Commits

Include renames

Author	SHA1	Message	Date
jaredandClaude Opus 4.8	b72d6620cc	chore(nginx): widen CSP frame-src to https: for room widgets (MSC1236) ... Room widgets embed arbitrary third-party https pages in a sandboxed iframe; frame-src was 'self' + openstreetmap only. Apply + nginx -s reload. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-03 13:27:23 -04:00
jaredandClaude Opus 4.8	64262b39ec	chore(nginx): drop api.qrserver.com from CSP (invite QR now generated locally) ... Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-02 22:19:22 -04:00
jaredandClaude Opus 4.8	6293a62e47	feat(nginx): add HSTS + Permissions-Policy to chat.lotusguild.org (P6-4) ... Adds Strict-Transport-Security (2y, includeSubDomains, preload) and a Permissions-Policy that allows only the features the app uses (camera/mic/ display-capture for calls, geolocation for location share, autoplay/fullscreen/ encrypted-media) and denies the rest. Complements the existing X-Frame/CSP/ Referrer headers. Apply: reload nginx on the LXC. TLS terminates upstream (listen 80), so verify the header reaches the browser (front proxy must pass it through) — else set HSTS at the TLS terminator. Verify a call + location share still work. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-02 14:41:08 -04:00
jaredandClaude Opus 4.8	d6fd323262	cinny: enable mozilla.org (OIDC/next-gen-auth homeserver) ... Now that the client supports MSC3861 OIDC login, add mozilla.org to the homeserverList and its origins to the CSP. mozilla delegates: homeserver -> mozilla.modular.im, OIDC issuer -> chat.mozilla.org, identity -> vector.im. - connect-src += mozilla.org mozilla.modular.im chat.mozilla.org vector.im - img-src += mozilla.org mozilla.modular.im Applied live to LXC 106 and synced here. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-30 16:58:48 -04:00
jaredandClaude Opus 4.8	b39e3594d5	cinny: allow matrix.org media in CSP img-src ... Federated matrix.org users load avatars/images from their own media endpoint (matrix-client.matrix.org), which img-src still blocked — so every avatar tripped a CSP violation. Add https://matrix.org + https://*.matrix.org to img-src to match connect-src. (media-src already allows https: so video/audio were fine.) Applied live to LXC 106 and synced here. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-30 14:49:08 -04:00
jaredandClaude Opus 4.8	40ceb43672	cinny: version-control the production nginx site config ... The chat.lotusguild.org nginx config (LXC 106) was edited directly on the box and never tracked — which is how its CSP drifted (kept a dead Sentry URL and blocked matrix.org logins). Snapshot it as cinny/nginx.conf (verbatim from prod, incl. the corrected connect-src that now allows matrix.org/*.matrix.org) and deploy it via lxc106-cinny.sh: back up the live file, swap, `nginx -t`, and reload only on success (auto-restore the backup if validation fails, so a bad config can't take the site down). TLS terminates at the NPM proxy, so this is a plain HTTP server block with no secrets. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-30 13:14:49 -04:00