summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* nginx: enforce piped CSP, drop dead freshrss CSP and rss vhostChristian Cleberg3 days4-52/+14
| | | | | | | | | | | | | | | | | | | | | | Promote piped.krz.sh from Content-Security-Policy-Report-Only to enforcing. Validated in a real browser first: homepage, VOD playback and seek on two videos, channel page and a 39-result search were all clean, and every host contacted was already allowed (self, pipedapi, pipedproxy, blob:). No fallback to pipedproxy.kavin.rocks, so viewer IPs stay on the self-hosted proxy. The check was proven meaningful before being trusted by injecting a disallowed image and confirming a securitypolicyviolation with disposition "report". Remove the FreshRSS CSP (include file plus the $csp_freshrss map). The header never reached a browser: rss.krz.sh is routed tunnel-direct to the container on :8099 and never transits nginx. Promoting it would also have regressed behaviour rather than hardened it, since browsers enforce the intersection of stacked policies and this one was stricter than FreshRSS's own exactly where feed content lives (no blob: in img-src, no * in media-src/frame-src). FreshRSS keeps its own, correctly RSS-aware, policy. Delete conf.d/rss.conf entirely. It was unreachable: no onion targets :10045, no other vhost uses the port, and rss.zerolabs.sh is redirected to rss.krz.sh at the Cloudflare edge before the origin is reached.
* fix security headers for new vhostsChristian Cleberg3 days5-2/+52
|
* add i.confChristian Cleberg3 days1-0/+9
|
* revamp security headers and site confsChristian Cleberg4 days21-90/+239
|
* chore: cleanupChristian Cleberg4 days2-1/+87
|
* chore: cleanupChristian Cleberg4 days28-244/+62
|
* fix krz.sh.confChristian Cleberg4 days1-0/+8
|
* add git.confChristian Cleberg4 days1-0/+91
|
* add node and rustChristian Cleberg4 days2-0/+8
|
* update ispell and doomChristian Cleberg4 days3-1/+24
|
* rm sshChristian Cleberg4 days2-45/+0
|
* minor updatesChristian Cleberg4 days3-3/+5
|
* update rogueChristian Cleberg4 days2-12/+12
|
* remove autheliaChristian Cleberg5 days2-38/+0
|
* update nanorcChristian Cleberg12 days1-0/+0
|
* update brew files and add nanorcChristian Cleberg12 days4-6/+54
|
* enable macos agent keysChristian Cleberg2026-05-261-7/+3
|
* add olivetti to emacsChristian Cleberg2026-05-262-0/+2
|
* fix: update motd to be consistently useful across personal and managed macsChristian Cleberg2026-05-181-4/+46
|
* fix: lazy load nvm and compinit on managed mac to reduce startup timesChristian Cleberg2026-05-181-8/+26
|
* fix zshChristian Cleberg2026-05-181-0/+2
|
* update dictChristian Cleberg2026-05-181-0/+45
|
* daily updatesChristian Cleberg2026-05-181-1/+3
|
* update macos motdChristian Cleberg2026-05-141-1/+1
|
* update macos motdChristian Cleberg2026-05-142-1/+17
|
* fix: format latest nginx conf changesChristian Cleberg2026-05-101-133/+37
|
* fix: format latest nginx conf changesChristian Cleberg2026-05-101-48/+39
|
* fix: add redirect file cleberg.netChristian Cleberg2026-05-102-1/+140
|
* fix: 404 for .well-known to reduce warningsChristian Cleberg2026-05-101-4/+5
|
* add macos motd scriptChristian Cleberg2026-05-102-1/+7
|
* fix: add motd for macosChristian Cleberg2026-05-101-0/+2
|
* fix: ensure port doesn't leak during slash redirectsChristian Cleberg2026-05-101-0/+1
|
* remove stray fileChristian Cleberg2026-05-011-38/+0
|
* fix: enable markdown serving via org on cleberg.netChristian Cleberg2026-05-011-10/+1
|
* fix: enable markdown serving via org on cleberg.netChristian Cleberg2026-05-012-5/+53
|
* migrate docker from nginx to cloudflared tunnelChristian Cleberg2026-04-303-153/+1
|
* comment-out macos-specific ssh optionsChristian Cleberg2026-04-301-3/+3
|
* add docker-update commandChristian Cleberg2026-04-301-0/+1
|
* migrate docker from nginx to cloudflared tunnelChristian Cleberg2026-04-3031-533/+6
|
* remove authChristian Cleberg2026-04-308-32/+0
|
* update backendsChristian Cleberg2026-04-301-0/+3
|
* Merge pull request #1 from ↵Christian Cleberg2026-04-3045-868/+208
|\ | | | | | | | | ccleberg/codex/update-nginx-conf.d-files-port-configuration nginx: move vhosts to high ports, remove SSL includes, add cleberg.net redirects
| * Add cleberg.net canonical redirects for zerolabs subdomainsChristian Cleberg2026-04-3045-868/+208
|/
* move zerolabs to local port, remove authelia from irc, and update ↵Christian Cleberg2026-04-304-20/+25
| | | | cleberg.net logging
* fix timeout for bb.zerolabs.shChristian Cleberg2026-04-182-2/+6
|
* add bb.zerolabs.shChristian Cleberg2026-04-181-0/+23
|
* fix IP address mappingsChristian Cleberg2026-04-151-2/+2
|
* fix IP address mappingsChristian Cleberg2026-04-151-18/+18
|
* remove rimgoChristian Cleberg2026-04-151-39/+0
|
* increase hash sizeChristian Cleberg2026-04-151-4/+4
|
generated by cgit v1.2.3 (git 2.39.1) at 2026-08-07 04:52:38 +0000