3 Commits

Include renames

Author	SHA1	Message	Date
Lotus CIandClaude Opus 5.5	9fcbd410f2	cinny CSP: allow the app to read the Kuma status page (cinny #124) ... Add https://isitup.lotusguild.org to connect-src so the client can fetch the public status JSON (GET /api/status-page/matrix and /api/status-page/heartbeat/matrix) for the homeserver status banner. Read-only public JSON, no credentials; nothing else changes. The live snippet (/etc/nginx/snippets/cinny-security-headers.conf on LXC 106) was identical to this file before the change; install it by hand with a backup and `nginx -t` (the deploy script only handles cinny/nginx.conf). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-29 12:08:45 -04:00
Lotus CIandClaude Opus 5.5	9c5a183025	feat(cinny): nginx for Element Call on call.chat.lotusguild.org (cinny #43) ... - cinny/nginx.conf: a call.chat.lotusguild.org server block that serves ONLY /public/element-call/ (the same files chat.lotusguild.org already serves there) and 404s everything else, including source maps and dotfiles. - cinny/nginx-security-headers-call.conf (new snippet): frame-ancestors https://chat.lotusguild.org instead of X-Frame-Options SAMEORIGIN, which would block the now cross-origin parent. - cinny/nginx-security-headers.conf: the app's Permissions-Policy delegates autoplay/camera/display-capture/microphone to the call origin (without it the cross-origin frame's getUserMedia is refused). Outer quotes switched to single: the inner "origin" quotes broke nginx parsing. Nothing changes for users until config.json sets elementCallUrl (separate step). Snippets are installed by hand on LXC 106; nginx.conf deploys on merge. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-26 23:24:32 -04:00
Lotus CIandClaude Opus 5.5	23ad133dc3	cinny(nginx): security headers on every location; sync repo with live (cinny #210, #214, #155) ... Applied on LXC 106 (backed up, `nginx -t`, reloaded) and recorded here: - Security headers (incl. CSP) moved to snippets/cinny-security-headers.conf and included at server level plus in the /sw.js, static-asset and json/html locations. nginx drops inherited add_header in any block that sets its own, so static assets were served without nosniff and /sw.js without a CSP (a service worker takes its CSP from its own script). Now every path carries all seven headers. Verified: the SW installs and controls the page under the CSP with no violations. - #214: CSP no longer allows fonts.googleapis.com / fonts.gstatic.com (VT323 is self-hosted since cinny 6f250353). - #155: the /share-target → /share 303 is now live (it was only in the repo; the 106 matrix-deploy hook has been dead since May, so repo edits never reached it). absolute_redirect off makes it relative. - README: the snippet, and that 106 needs these applied by hand. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-23 23:17:53 -04:00