Lotus CIandClaude Opus 5.5
23ad133dc3
Lint / Shell (shellcheck) (push) Successful in 13s
Lint / JS (eslint) (push) Successful in 12s
Lint / No secrets in webhook configs (push) Successful in 6s
Lint / Python (ruff) (push) Successful in 9s
Lint / Python deps (pip-audit) (push) Successful in 1m9s
Lint / Secret scan (gitleaks) (push) Successful in 10s
Applied on LXC 106 (backed up, `nginx -t`, reloaded) and recorded here: - Security headers (incl. CSP) moved to snippets/cinny-security-headers.conf and included at server level plus in the /sw.js, static-asset and json/html locations. nginx drops inherited add_header in any block that sets its own, so static assets were served without nosniff and /sw.js without a CSP (a service worker takes its CSP from its own script). Now every path carries all seven headers. Verified: the SW installs and controls the page under the CSP with no violations. - #214: CSP no longer allows fonts.googleapis.com / fonts.gstatic.com (VT323 is self-hosted since cinny 6f250353). - #155: the /share-target → /share 303 is now live (it was only in the repo; the 106 matrix-deploy hook has been dead since May, so repo edits never reached it). absolute_redirect off makes it relative. - README: the snippet, and that 106 needs these applied by hand. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA
94 lines
3.2 KiB
Nginx Configuration File
94 lines
3.2 KiB
Nginx Configuration File
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
server_name chat.lotusguild.org;
|
|
|
|
# Brotli compression (better than gzip for modern browsers)
|
|
brotli on;
|
|
brotli_static on;
|
|
brotli_comp_level 6;
|
|
brotli_types text/plain text/css application/javascript application/json
|
|
image/svg+xml application/wasm font/woff2;
|
|
|
|
root /var/www/html;
|
|
server_tokens off;
|
|
client_max_body_size 50m;
|
|
|
|
limit_req zone=chat_limit burst=60 nodelay;
|
|
limit_conn chat_conn 25;
|
|
index index.html;
|
|
|
|
# Security headers (incl. CSP) — see the snippet
|
|
include snippets/cinny-security-headers.conf;
|
|
# HSTS: TLS terminates upstream (this server is listen 80), so this reaches
|
|
# the browser only if the front proxy passes upstream response headers
|
|
# through; otherwise set it at the TLS terminator. includeSubDomains covers
|
|
# all *.lotusguild.org (all HTTPS); `preload` is inert until submitted to
|
|
# hstspreload.org.
|
|
# Permissions-Policy: allow only what the app uses (self) — calls
|
|
# (camera/microphone/display-capture), location share (geolocation), sounds
|
|
# (autoplay), Element Call (fullscreen/encrypted-media) — and deny the rest.
|
|
|
|
# Block all source map files and dotfiles from public access
|
|
location ~* \.(js|css)\.map$ {
|
|
deny all;
|
|
return 404;
|
|
}
|
|
location ~ /\. {
|
|
deny all;
|
|
return 404;
|
|
}
|
|
location = /netlify.toml {
|
|
deny all;
|
|
return 404;
|
|
}
|
|
|
|
|
|
# Service worker must never be cached so updates are picked up immediately
|
|
location = /sw.js {
|
|
include snippets/cinny-security-headers.conf;
|
|
expires -1;
|
|
add_header Cache-Control "no-cache, no-store, must-revalidate" always;
|
|
}
|
|
|
|
# Cache content-addressed static assets aggressively
|
|
location ~* \.(?:js|css|woff2?|png|svg|ico|webp)$ {
|
|
include snippets/cinny-security-headers.conf;
|
|
expires 1y;
|
|
add_header Cache-Control "public, immutable" always;
|
|
}
|
|
|
|
# Never cache HTML or JSON (index.html, config.json, manifest.json)
|
|
location ~* \.(json|html)$ {
|
|
include snippets/cinny-security-headers.conf;
|
|
expires -1;
|
|
add_header Cache-Control "no-cache, no-store, must-revalidate" always;
|
|
}
|
|
|
|
# [Gitea #155] PWA share target. The service worker normally answers this
|
|
# POST itself; if it isn't controlling the page yet, land on /share
|
|
# (the shared files are lost, but nothing 405s).
|
|
location = /share-target {
|
|
absolute_redirect off;
|
|
return 303 /share;
|
|
}
|
|
|
|
# Auto-deploy webhook — proxied to local webhook service
|
|
location = /hooks/lotus-deploy {
|
|
proxy_pass http://127.0.0.1:9001/hooks/lotus-deploy;
|
|
proxy_set_header Host $host;
|
|
proxy_read_timeout 300;
|
|
proxy_connect_timeout 5;
|
|
}
|
|
|
|
location / {
|
|
rewrite ^/config\.json$ /config.json break;
|
|
rewrite ^/manifest\.json$ /manifest.json break;
|
|
rewrite ^/sw\.js$ /sw.js break;
|
|
rewrite ^/pdf\.worker\.min\.js$ /pdf.worker.min.js break;
|
|
rewrite ^/public/(.*)$ /public/$1 break;
|
|
rewrite ^/assets/(.*)$ /assets/$1 break;
|
|
rewrite ^(.+)$ /index.html break;
|
|
}
|
|
}
|