LotusGuild/matrix
3
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity
197 Commits 4 Branches 0 Tags
9c5a1830257d6083f7f2bb8026f06f14a470ab48
Commit Graph
2 Commits
Author SHA1 Message Date
Lotus CIandClaude Opus 5.5 9c5a183025 feat(cinny): nginx for Element Call on call.chat.lotusguild.org (cinny #43)
Lint / Shell (shellcheck) (push) Successful in 21s
Details
Lint / JS (eslint) (push) Successful in 14s
Details
Lint / No secrets in webhook configs (push) Successful in 6s
Details
Lint / Landing page is rendered (matrix (push) Successful in 6s
Details
Lint / Python (ruff) (push) Successful in 7s
Details
Lint / Python deps (pip-audit) (push) Successful in 52s
Details
Lint / Secret scan (gitleaks) (push) Successful in 8s
Details
Lint / Shell (shellcheck) (pull_request) Successful in 17s
Details
Lint / JS (eslint) (pull_request) Successful in 13s
Details
Lint / No secrets in webhook configs (pull_request) Successful in 6s
Details
Lint / Landing page is rendered (matrix (pull_request) Successful in 6s
Details
Lint / Python (ruff) (pull_request) Successful in 8s
Details
Lint / Python deps (pip-audit) (pull_request) Successful in 53s
Details
Lint / Secret scan (gitleaks) (pull_request) Successful in 8s
Details 
- cinny/nginx.conf: a call.chat.lotusguild.org server block that serves ONLY
  /public/element-call/ (the same files chat.lotusguild.org already serves
  there) and 404s everything else, including source maps and dotfiles.
- cinny/nginx-security-headers-call.conf (new snippet): frame-ancestors
  https://chat.lotusguild.org instead of X-Frame-Options SAMEORIGIN, which
  would block the now cross-origin parent.
- cinny/nginx-security-headers.conf: the app's Permissions-Policy delegates
  autoplay/camera/display-capture/microphone to the call origin (without it
  the cross-origin frame's getUserMedia is refused). Outer quotes switched to
  single: the inner "origin" quotes broke nginx parsing.

Nothing changes for users until config.json sets elementCallUrl (separate
step). Snippets are installed by hand on LXC 106; nginx.conf deploys on merge.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA
 2026-09-26 23:24:32 -04:00
Lotus CIandClaude Opus 5.5 23ad133dc3 cinny(nginx): security headers on every location; sync repo with live (cinny #210, #214, #155)
Lint / Shell (shellcheck) (push) Successful in 13s
Details
Lint / JS (eslint) (push) Successful in 12s
Details
Lint / No secrets in webhook configs (push) Successful in 6s
Details
Lint / Python (ruff) (push) Successful in 9s
Details
Lint / Python deps (pip-audit) (push) Successful in 1m9s
Details
Lint / Secret scan (gitleaks) (push) Successful in 10s
Details 
Applied on LXC 106 (backed up, `nginx -t`, reloaded) and recorded here:

- Security headers (incl. CSP) moved to snippets/cinny-security-headers.conf
  and included at server level plus in the /sw.js, static-asset and
  json/html locations. nginx drops inherited add_header in any block that
  sets its own, so static assets were served without nosniff and /sw.js
  without a CSP (a service worker takes its CSP from its own script).
  Now every path carries all seven headers. Verified: the SW installs and
  controls the page under the CSP with no violations.
- #214: CSP no longer allows fonts.googleapis.com / fonts.gstatic.com
  (VT323 is self-hosted since cinny 6f250353).
- #155: the /share-target → /share 303 is now live (it was only in the
  repo; the 106 matrix-deploy hook has been dead since May, so repo edits
  never reached it). absolute_redirect off makes it relative.
- README: the snippet, and that 106 needs these applied by hand.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA
 2026-09-23 23:17:53 -04:00