summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* updatesmainChristian Cleberg10 hours1-0/+2
|
* nginx: make cleberg.net self-contained on the onionChristian Cleberg10 hours2-14/+52
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Serve images same-origin via a `location /img/ { alias /var/www/img/; }` block on cleberg.net, so the .onion no longer pulls subresources from the clearnet. Deliberately an nginx alias rather than a filesystem symlink. A symlink at /var/www/cleberg.net/img worked but was destroyed by the very next deploy -- the site deploys with `rsync --delete`, which removes anything in the destination that is not in the source tree, and that silently 404'd every image on the site. Config-level aliasing cannot be removed by a deploy. Tighten the cleberg.* CSP now that the site loads nothing cross-origin. The weblorg source was changed to emit root-relative stylesheet and image URLs, and the bubbles.town script was dropped, so parsing all deployed HTML returns zero absolute subresources. Dropped img-src https://img.cleberg.net, style-src and font-src https://cleberg.net, and script-src/connect-src https://bubbles.town; the policy is now default-src 'self' with no host allowances. upgrade-insecure-requests stays omitted: this vhost also serves the .onion over plain http, where it would upgrade same-origin subresource URLs to https and break them. Set Referrer-Policy to same-origin, restoring the value Cloudflare's security-headers toggle had been supplying. Removing that toggle silently regressed it to strict-origin-when-cross-origin, which still sends the origin to external sites; same-origin sends no referrer cross-origin at all. Verified over a real Tor circuit: article pages carry 4 relative subresources and 0 absolute, and images serve 200 from the onion.
* nginx: enforce piped CSP, drop dead freshrss CSP and rss vhostChristian Cleberg13 hours4-52/+14
| | | | | | | | | | | | | | | | | | | | | | Promote piped.krz.sh from Content-Security-Policy-Report-Only to enforcing. Validated in a real browser first: homepage, VOD playback and seek on two videos, channel page and a 39-result search were all clean, and every host contacted was already allowed (self, pipedapi, pipedproxy, blob:). No fallback to pipedproxy.kavin.rocks, so viewer IPs stay on the self-hosted proxy. The check was proven meaningful before being trusted by injecting a disallowed image and confirming a securitypolicyviolation with disposition "report". Remove the FreshRSS CSP (include file plus the $csp_freshrss map). The header never reached a browser: rss.krz.sh is routed tunnel-direct to the container on :8099 and never transits nginx. Promoting it would also have regressed behaviour rather than hardened it, since browsers enforce the intersection of stacked policies and this one was stricter than FreshRSS's own exactly where feed content lives (no blob: in img-src, no * in media-src/frame-src). FreshRSS keeps its own, correctly RSS-aware, policy. Delete conf.d/rss.conf entirely. It was unreachable: no onion targets :10045, no other vhost uses the port, and rss.zerolabs.sh is redirected to rss.krz.sh at the Cloudflare edge before the origin is reached.
* fix security headers for new vhostsChristian Cleberg14 hours5-2/+52
|
* add i.confChristian Cleberg14 hours1-0/+9
|
* revamp security headers and site confsChristian Cleberg14 hours21-90/+239
|
* chore: cleanupChristian Cleberg26 hours2-1/+87
|
* chore: cleanupChristian Cleberg26 hours28-244/+62
|
* fix krz.sh.confChristian Cleberg31 hours1-0/+8
|
* add git.confChristian Cleberg33 hours1-0/+91
|
* add node and rustChristian Cleberg33 hours2-0/+8
|
* update ispell and doomChristian Cleberg33 hours3-1/+24
|
* rm sshChristian Cleberg33 hours2-45/+0
|
* minor updatesChristian Cleberg36 hours3-3/+5
|
* update rogueChristian Cleberg37 hours2-12/+12
|
* remove autheliaChristian Cleberg2 days2-38/+0
|
* update nanorcChristian Cleberg9 days1-0/+0
|
* update brew files and add nanorcChristian Cleberg9 days4-6/+54
|
* enable macos agent keysChristian Cleberg2026-05-261-7/+3
|
* add olivetti to emacsChristian Cleberg2026-05-262-0/+2
|
* fix: update motd to be consistently useful across personal and managed macsChristian Cleberg2026-05-181-4/+46
|
* fix: lazy load nvm and compinit on managed mac to reduce startup timesChristian Cleberg2026-05-181-8/+26
|
* fix zshChristian Cleberg2026-05-181-0/+2
|
* update dictChristian Cleberg2026-05-181-0/+45
|
* daily updatesChristian Cleberg2026-05-181-1/+3
|
* update macos motdChristian Cleberg2026-05-141-1/+1
|
* update macos motdChristian Cleberg2026-05-142-1/+17
|
* fix: format latest nginx conf changesChristian Cleberg2026-05-101-133/+37
|
* fix: format latest nginx conf changesChristian Cleberg2026-05-101-48/+39
|
* fix: add redirect file cleberg.netChristian Cleberg2026-05-102-1/+140
|
* fix: 404 for .well-known to reduce warningsChristian Cleberg2026-05-101-4/+5
|
* add macos motd scriptChristian Cleberg2026-05-102-1/+7
|
* fix: add motd for macosChristian Cleberg2026-05-101-0/+2
|
* fix: ensure port doesn't leak during slash redirectsChristian Cleberg2026-05-101-0/+1
|
* remove stray fileChristian Cleberg2026-05-011-38/+0
|
* fix: enable markdown serving via org on cleberg.netChristian Cleberg2026-05-011-10/+1
|
* fix: enable markdown serving via org on cleberg.netChristian Cleberg2026-05-012-5/+53
|
* migrate docker from nginx to cloudflared tunnelChristian Cleberg2026-04-303-153/+1
|
* comment-out macos-specific ssh optionsChristian Cleberg2026-04-301-3/+3
|
* add docker-update commandChristian Cleberg2026-04-301-0/+1
|
* migrate docker from nginx to cloudflared tunnelChristian Cleberg2026-04-3031-533/+6
|
* remove authChristian Cleberg2026-04-308-32/+0
|
* update backendsChristian Cleberg2026-04-301-0/+3
|
* Merge pull request #1 from ↵Christian Cleberg2026-04-3045-868/+208
|\ | | | | | | | | ccleberg/codex/update-nginx-conf.d-files-port-configuration nginx: move vhosts to high ports, remove SSL includes, add cleberg.net redirects
| * Add cleberg.net canonical redirects for zerolabs subdomainsChristian Cleberg2026-04-3045-868/+208
|/
* move zerolabs to local port, remove authelia from irc, and update ↵Christian Cleberg2026-04-304-20/+25
| | | | cleberg.net logging
* fix timeout for bb.zerolabs.shChristian Cleberg2026-04-182-2/+6
|
* add bb.zerolabs.shChristian Cleberg2026-04-181-0/+23
|
* fix IP address mappingsChristian Cleberg2026-04-151-2/+2
|
* fix IP address mappingsChristian Cleberg2026-04-151-18/+18
|
generated by cgit v1.2.3 (git 2.39.1) at 2026-08-04 07:11:42 +0000