mirror of
https://github.com/YunoHost-Apps/akkoma_ynh.git
synced 2024-09-03 20:36:17 +02:00
1dcd325856
* fix syntax * Bump version * Auto-update README * Update nginx.conf (#40) * Update nginx.conf Fix bug in which media was being scrubbed out by CSP * Use __PORT__ instead of fixed value --------- Co-authored-by: lapineige <lapineige@users.noreply.github.com> --------- Co-authored-by: yunohost-bot <yunohost@yunohost.org> Co-authored-by: Twizzay <88040412+twizzay-code@users.noreply.github.com>
57 lines
2.4 KiB
Nginx Configuration File
57 lines
2.4 KiB
Nginx Configuration File
location / {
|
|
|
|
# Standard nginx configuration
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header Host $http_host;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
|
|
proxy_pass http://127.0.0.1:__PORT__;
|
|
|
|
client_max_body_size 50M;
|
|
|
|
more_set_headers "Access-Control-Allow-Origin : *";
|
|
more_set_headers "Access-Control-Allow-Methods : POST, PUT, DELETE, GET, PATCH, OPTIONS";
|
|
more_set_headers "Access-Control-Allow-Headers : Authorization, Content-Type, Idempotency-Key";
|
|
more_set_headers "Access-Control-Expose-Headers : Link, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining, X-Request-Id";
|
|
if ($request_method = OPTIONS) {
|
|
return 204;
|
|
}
|
|
# stop removing lines here.
|
|
|
|
more_set_headers "X-XSS-Protection : 1; mode=block";
|
|
more_set_headers "X-Permitted-Cross-Domain-Policies : none";
|
|
more_set_headers "X-Frame-Options : DENY";
|
|
more_set_headers "X-Content-Type-Options : nosniff";
|
|
more_set_headers "Referrer-Policy : same-origin";
|
|
more_set_headers "X-Download-Options : noopen";
|
|
# more_set_headers "Content-Security-Policy : default-src 'none'; base-uri 'self'; form-action *; frame-ancestors 'none'; img-src 'self' data: https:; media-src 'self' https:; style-src 'self' 'unsafe-inline'; font-src 'self'; script-src 'self'; connect-src 'self' wss://__DOMAIN__; upgrade-insecure-requests;";
|
|
|
|
# Uncomment this only after you get HTTPS working.
|
|
# more_set_headers "Strict-Transport-Security : max-age=31536000; includeSubDomains";
|
|
|
|
|
|
# Include SSOWAT user panel.
|
|
include conf.d/yunohost_panel.conf.inc;
|
|
}
|
|
|
|
rewrite ^/proxy/(.*)/(.*)/.* /proxy/$1/$2 last;
|
|
|
|
location ~ ^/(media|proxy) {
|
|
proxy_cache akkoma_media_cache;
|
|
proxy_cache_key $host$uri$is_args$args;
|
|
proxy_http_version 1.1;
|
|
proxy_cache_valid 200 206 301 304 1h;
|
|
proxy_cache_lock on;
|
|
proxy_ignore_client_abort on;
|
|
proxy_buffering on;
|
|
chunked_transfer_encoding on;
|
|
# added some stuff that seirdy said to add to make me bullet proof. B-) https://akkoma.dev/AkkomaGang/akkoma/issues/547#issuecomment-9261
|
|
more_set_headers "Content-Security-Policy : script-src 'none'; default-src 'none'; upgrade-insecure-requests; base-uri 'none'; form-action 'none'; 'sandbox';";
|
|
|
|
proxy_pass http://localhost:__PORT__;
|
|
=======
|
|
location ~ ^/(proxy|media) {
|
|
more_set_headers "Content-Security-Policy : default-src 'none'; upgrade-insecure-requests; sandbox;";
|
|
}
|