dotfiles.git/linux/nginx/etc, branch mainpersonal dotfiles. shell, editor, and server configs.
http://git.krz.sh/cmc/dotfiles.git/atom?h=main2026-08-03T20:47:25+00:00nginx: make cleberg.net self-contained on the onion2026-08-03T20:47:25+00:00Christian Cleberghello@cleberg.net2026-08-03T20:47:25+00:00urn:sha1:3e8b89ec7012ab1766b2458a38d5ac32cb748446
Serve images same-origin via a `location /img/ { alias /var/www/img/; }` block
on cleberg.net, so the .onion no longer pulls subresources from the clearnet.
Deliberately an nginx alias rather than a filesystem symlink. A symlink at
/var/www/cleberg.net/img worked but was destroyed by the very next deploy --
the site deploys with `rsync --delete`, which removes anything in the
destination that is not in the source tree, and that silently 404'd every image
on the site. Config-level aliasing cannot be removed by a deploy.
Tighten the cleberg.* CSP now that the site loads nothing cross-origin. The
weblorg source was changed to emit root-relative stylesheet and image URLs, and
the bubbles.town script was dropped, so parsing all deployed HTML returns zero
absolute subresources. Dropped img-src https://img.cleberg.net, style-src and
font-src https://cleberg.net, and script-src/connect-src https://bubbles.town;
the policy is now default-src 'self' with no host allowances.
upgrade-insecure-requests stays omitted: this vhost also serves the .onion over
plain http, where it would upgrade same-origin subresource URLs to https and
break them.
Set Referrer-Policy to same-origin, restoring the value Cloudflare's
security-headers toggle had been supplying. Removing that toggle silently
regressed it to strict-origin-when-cross-origin, which still sends the origin
to external sites; same-origin sends no referrer cross-origin at all.
Verified over a real Tor circuit: article pages carry 4 relative subresources
and 0 absolute, and images serve 200 from the onion.
nginx: enforce piped CSP, drop dead freshrss CSP and rss vhost2026-08-03T17:55:47+00:00Christian Cleberghello@cleberg.net2026-08-03T17:55:47+00:00urn:sha1:7628832bfe9aaf3deafc2787e596e0ca65b0cad0
Promote piped.krz.sh from Content-Security-Policy-Report-Only to enforcing.
Validated in a real browser first: homepage, VOD playback and seek on two
videos, channel page and a 39-result search were all clean, and every host
contacted was already allowed (self, pipedapi, pipedproxy, blob:). No fallback
to pipedproxy.kavin.rocks, so viewer IPs stay on the self-hosted proxy. The
check was proven meaningful before being trusted by injecting a disallowed
image and confirming a securitypolicyviolation with disposition "report".
Remove the FreshRSS CSP (include file plus the $csp_freshrss map). The header
never reached a browser: rss.krz.sh is routed tunnel-direct to the container
on :8099 and never transits nginx. Promoting it would also have regressed
behaviour rather than hardened it, since browsers enforce the intersection of
stacked policies and this one was stricter than FreshRSS's own exactly where
feed content lives (no blob: in img-src, no * in media-src/frame-src).
FreshRSS keeps its own, correctly RSS-aware, policy.
Delete conf.d/rss.conf entirely. It was unreachable: no onion targets :10045,
no other vhost uses the port, and rss.zerolabs.sh is redirected to rss.krz.sh
at the Cloudflare edge before the origin is reached.
fix security headers for new vhosts2026-08-03T17:03:54+00:00Christian Cleberghello@cleberg.net2026-08-03T17:03:54+00:00urn:sha1:263f281b30ac0f7daaf654e2e9abee71f9d80709add i.conf2026-08-03T16:53:17+00:00Christian Cleberghello@cleberg.net2026-08-03T16:53:17+00:00urn:sha1:3d0c165f492b13fdfecd98498eac191a5f67deberevamp security headers and site confs2026-08-03T16:43:15+00:00Christian Cleberghello@cleberg.net2026-08-03T16:43:15+00:00urn:sha1:41618d30fc1fdc9ef26aa5003ac48fadf0d1fe82chore: cleanup2026-08-03T05:41:00+00:00Christian Cleberghello@cleberg.net2026-08-03T05:41:00+00:00urn:sha1:0c68f866ef5823b23877188c4057a00d913bc115chore: cleanup2026-08-03T05:31:22+00:00Christian Cleberghello@cleberg.net2026-08-03T05:31:22+00:00urn:sha1:565e8c2db8e79197ffb49554a70e209fa1ead16efix krz.sh.conf2026-08-02T23:46:05+00:00Christian Cleberghello@cleberg.net2026-08-02T23:46:05+00:00urn:sha1:6783d54468506e8d42a60554855b2aee124f1f24add git.conf2026-08-02T21:49:40+00:00Christian Cleberghello@cleberg.net2026-08-02T21:49:19+00:00urn:sha1:fd10a8a033e1e1c5d016968c2fbd296ec6ae1656update rogue2026-08-02T18:40:25+00:00Christian Cleberghello@cleberg.net2026-08-02T18:40:25+00:00urn:sha1:347c36526205a81385f10cdb301f94fb05118339