matrix

Applied on LXC 106 (backed up, `nginx -t`, reloaded) and recorded here:

- Security headers (incl. CSP) moved to snippets/cinny-security-headers.conf
  and included at server level plus in the /sw.js, static-asset and
  json/html locations. nginx drops inherited add_header in any block that
  sets its own, so static assets were served without nosniff and /sw.js
  without a CSP (a service worker takes its CSP from its own script).
  Now every path carries all seven headers. Verified: the SW installs and
  controls the page under the CSP with no violations.
- #214: CSP no longer allows fonts.googleapis.com / fonts.gstatic.com
  (VT323 is self-hosted since cinny 6f250353).
- #155: the /share-target → /share 303 is now live (it was only in the
  repo; the 106 matrix-deploy hook has been dead since May, so repo edits
  never reached it). absolute_redirect off makes it relative.
- README: the snippet, and that 106 needs these applied by hand.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA

2026-09-23 23:17:53 -04:00

config.json

fix(cinny): restore gifApiKey placeholder + redact leaked key from README

2026-07-08 00:56:47 -04:00

lotus_deploy.sh

fix(cinny-deploy): queue a trigger that arrives mid-deploy instead of dropping it

2026-09-14 19:25:28 -04:00

lotus-build.sh

fix(cinny): upstream-merge script pushes and hands off to CI instead of deploying

2026-09-13 00:44:44 -04:00

nginx-security-headers.conf

cinny(nginx): security headers on every location; sync repo with live (cinny #210 , #214 , #155 )

2026-09-23 23:17:53 -04:00

nginx.conf

cinny(nginx): security headers on every location; sync repo with live (cinny #210 , #214 , #155 )

2026-09-23 23:17:53 -04:00

upstream-check.sh

Switch Lotus Cinny from nightly dev to stable-release fork workflow

2026-05-13 16:57:35 -04:00