3 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Lotus CIandClaude Opus 5.5	d4fd1d0b8e	fix(cinny/nginx): let the app frame its bundled Element Call again ... Web calls broke ("nobody can join calls from the web version"): 23ad133 (cinny #210) put the security-headers snippet, including the app CSP, on every .html response. /public/element-call/index.html then carried frame-ancestors 'none', so the browser refused to load it inside the app ("Content-Security-Policy ... frame-ancestors 'none'"). Desktop was fine (it loads Element Call from its own bundle). Before #210 that page had no CSP. A `location ^~ /public/element-call/` now serves it with cinny-security-headers-framed.conf: the same headers minus the CSP (X-Frame-Options SAMEORIGIN still limits framing to chat.lotusguild.org), and the same caching (HTML no-cache, hashed assets 1 year). Applied live on LXC 106 (backup sites-available/cinny.bak-ecframe-*), nginx -t ok; verified from outside: no CSP on the call page, and the live site frames it and it loads ("Element Call"). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-25 19:26:44 -04:00
Lotus CIandClaude Opus 5.5	23ad133dc3	cinny(nginx): security headers on every location; sync repo with live (cinny #210, #214, #155) ... Applied on LXC 106 (backed up, `nginx -t`, reloaded) and recorded here: - Security headers (incl. CSP) moved to snippets/cinny-security-headers.conf and included at server level plus in the /sw.js, static-asset and json/html locations. nginx drops inherited add_header in any block that sets its own, so static assets were served without nosniff and /sw.js without a CSP (a service worker takes its CSP from its own script). Now every path carries all seven headers. Verified: the SW installs and controls the page under the CSP with no violations. - #214: CSP no longer allows fonts.googleapis.com / fonts.gstatic.com (VT323 is self-hosted since cinny 6f250353). - #155: the /share-target → /share 303 is now live (it was only in the repo; the 106 matrix-deploy hook has been dead since May, so repo edits never reached it). absolute_redirect off makes it relative. - README: the snippet, and that 106 needs these applied by hand. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-23 23:17:53 -04:00
Lotus CIandClaude Opus 5.5	1dacf29d53	security(deploy): webhook secrets out of git; all exposed ones rotated ... deploy/hooks-lxc*.json in this public repo held the HMAC secrets for every auto-deploy webhook (and 106's cinny-build token), readable anonymously. Six values had been committed: the four matrix-deploy secrets, 106's lotus-deploy secret (publicly reachable through chat.lotusguild.org/hooks/lotus-deploy) and the cinny-build token. - All six rotated on the servers and in Gitea (matrix hooks 6-9, cinny hook 69). The old values are rejected. - Secrets now live in /etc/webhook/secrets.env (0600) on each LXC, loaded by a systemd drop-in that also enables webhook's -template mode; the hooks files use {{ getenv "NAME" | js }} placeholders. - The repo hooks files are now exact copies of the live ones, so they also document the *-config-deploy hooks they were missing. Those three secrets were never committed and are unchanged. - README: where the secrets live and how to rotate one. - CI `hooks-no-secrets` fails if a literal secret lands in a hooks file again. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-23 22:29:52 -04:00