jared 6293a62e47 feat(nginx): add HSTS + Permissions-Policy to chat.lotusguild.org (P6-4) ...

Adds Strict-Transport-Security (2y, includeSubDomains, preload) and a
Permissions-Policy that allows only the features the app uses (camera/mic/
display-capture for calls, geolocation for location share, autoplay/fullscreen/
encrypted-media) and denies the rest. Complements the existing X-Frame/CSP/
Referrer headers.

Apply: reload nginx on the LXC. TLS terminates upstream (listen 80), so verify
the header reaches the browser (front proxy must pass it through) — else set
HSTS at the TLS terminator. Verify a call + location share still work.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-02 14:41:08 -04:00

..

config.json

cinny: enable mozilla.org (OIDC/next-gen-auth homeserver)

2026-06-30 16:58:48 -04:00

lotus_deploy.sh

fix(ci): make the SC1091 suppression in lotus_deploy.sh actually apply

2026-07-01 22:19:39 -04:00

lotus-build.sh

Fix NODE_OPTIONS heap size for Vite build (896MB → 6144MB)

2026-05-13 20:34:14 -04:00

nginx.conf

feat(nginx): add HSTS + Permissions-Policy to chat.lotusguild.org (P6-4)

2026-07-02 14:41:08 -04:00

upstream-check.sh

Switch Lotus Cinny from nightly dev to stable-release fork workflow

2026-05-13 16:57:35 -04:00