summaryrefslogtreecommitdiff
path: root/linux/nginx/etc
Commit message (Collapse)AuthorAgeFilesLines
* nginx: make cleberg.net self-contained on the onionChristian Cleberg18 hours2-14/+52
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Serve images same-origin via a `location /img/ { alias /var/www/img/; }` block on cleberg.net, so the .onion no longer pulls subresources from the clearnet. Deliberately an nginx alias rather than a filesystem symlink. A symlink at /var/www/cleberg.net/img worked but was destroyed by the very next deploy -- the site deploys with `rsync --delete`, which removes anything in the destination that is not in the source tree, and that silently 404'd every image on the site. Config-level aliasing cannot be removed by a deploy. Tighten the cleberg.* CSP now that the site loads nothing cross-origin. The weblorg source was changed to emit root-relative stylesheet and image URLs, and the bubbles.town script was dropped, so parsing all deployed HTML returns zero absolute subresources. Dropped img-src https://img.cleberg.net, style-src and font-src https://cleberg.net, and script-src/connect-src https://bubbles.town; the policy is now default-src 'self' with no host allowances. upgrade-insecure-requests stays omitted: this vhost also serves the .onion over plain http, where it would upgrade same-origin subresource URLs to https and break them. Set Referrer-Policy to same-origin, restoring the value Cloudflare's security-headers toggle had been supplying. Removing that toggle silently regressed it to strict-origin-when-cross-origin, which still sends the origin to external sites; same-origin sends no referrer cross-origin at all. Verified over a real Tor circuit: article pages carry 4 relative subresources and 0 absolute, and images serve 200 from the onion.
* nginx: enforce piped CSP, drop dead freshrss CSP and rss vhostChristian Cleberg21 hours4-52/+14
| | | | | | | | | | | | | | | | | | | | | | Promote piped.krz.sh from Content-Security-Policy-Report-Only to enforcing. Validated in a real browser first: homepage, VOD playback and seek on two videos, channel page and a 39-result search were all clean, and every host contacted was already allowed (self, pipedapi, pipedproxy, blob:). No fallback to pipedproxy.kavin.rocks, so viewer IPs stay on the self-hosted proxy. The check was proven meaningful before being trusted by injecting a disallowed image and confirming a securitypolicyviolation with disposition "report". Remove the FreshRSS CSP (include file plus the $csp_freshrss map). The header never reached a browser: rss.krz.sh is routed tunnel-direct to the container on :8099 and never transits nginx. Promoting it would also have regressed behaviour rather than hardened it, since browsers enforce the intersection of stacked policies and this one was stricter than FreshRSS's own exactly where feed content lives (no blob: in img-src, no * in media-src/frame-src). FreshRSS keeps its own, correctly RSS-aware, policy. Delete conf.d/rss.conf entirely. It was unreachable: no onion targets :10045, no other vhost uses the port, and rss.zerolabs.sh is redirected to rss.krz.sh at the Cloudflare edge before the origin is reached.
* fix security headers for new vhostsChristian Cleberg22 hours5-2/+52
|
* add i.confChristian Cleberg22 hours1-0/+9
|
* revamp security headers and site confsChristian Cleberg22 hours21-90/+239
|
* chore: cleanupChristian Cleberg33 hours2-1/+87
|
* chore: cleanupChristian Cleberg33 hours28-244/+62
|
* fix krz.sh.confChristian Cleberg39 hours1-0/+8
|
* add git.confChristian Cleberg41 hours1-0/+91
|
* update rogueChristian Cleberg44 hours2-12/+12
|
* remove autheliaChristian Cleberg2 days2-38/+0
|
* fix: format latest nginx conf changesChristian Cleberg2026-05-101-133/+37
|
* fix: format latest nginx conf changesChristian Cleberg2026-05-101-48/+39
|
* fix: add redirect file cleberg.netChristian Cleberg2026-05-102-1/+140
|
* fix: 404 for .well-known to reduce warningsChristian Cleberg2026-05-101-4/+5
|
* fix: ensure port doesn't leak during slash redirectsChristian Cleberg2026-05-101-0/+1
|
* remove stray fileChristian Cleberg2026-05-011-38/+0
|
* fix: enable markdown serving via org on cleberg.netChristian Cleberg2026-05-011-10/+1
|
* fix: enable markdown serving via org on cleberg.netChristian Cleberg2026-05-012-5/+53
|
* migrate docker from nginx to cloudflared tunnelChristian Cleberg2026-04-303-153/+1
|
* migrate docker from nginx to cloudflared tunnelChristian Cleberg2026-04-3031-533/+6
|
* remove authChristian Cleberg2026-04-308-32/+0
|
* update backendsChristian Cleberg2026-04-301-0/+3
|
* Add cleberg.net canonical redirects for zerolabs subdomainsChristian Cleberg2026-04-3045-868/+208
|
* move zerolabs to local port, remove authelia from irc, and update ↵Christian Cleberg2026-04-304-20/+25
| | | | cleberg.net logging
* fix timeout for bb.zerolabs.shChristian Cleberg2026-04-182-2/+6
|
* add bb.zerolabs.shChristian Cleberg2026-04-181-0/+23
|
* fix IP address mappingsChristian Cleberg2026-04-151-2/+2
|
* fix IP address mappingsChristian Cleberg2026-04-151-18/+18
|
* remove rimgoChristian Cleberg2026-04-151-39/+0
|
* increase hash sizeChristian Cleberg2026-04-151-4/+4
|
* increase hash sizeChristian Cleberg2026-04-151-0/+4
|
* rework nginx structureChristian Cleberg2026-04-1553-354/+392
|
* fix nginx warningsChristian Cleberg2026-04-152-39/+15
|
* fix duplicate .cleberg.net issueChristian Cleberg2026-04-152-6/+3
|
* remove IPv6 listenersChristian Cleberg2026-04-1545-141/+1
|
* fix: resolve multiple server names in default.conf and multiple 443 blocks in aoChristian Cleberg2026-04-153-31/+6
|
* redirect hutch to zerolabs.shChristian Cleberg2026-04-101-0/+22
|
* migrate service URIs to zerolabs.shChristian Cleberg2026-04-0937-163/+204
|
* add zerolabs.shChristian Cleberg2026-04-0940-46/+856
|
* Revert "add zerolabs.sh"Christian Cleberg2026-04-092-70/+0
| | | | This reverts commit 6624038ba7e8332350976104449e5dc4a623766d.
* add zerolabs.shChristian Cleberg2026-04-092-0/+70
|
* fix CSP for img.cleberg.netChristian Cleberg2026-04-081-1/+9
|
* add authelia to btChristian Cleberg2026-03-261-5/+5
|
* conf updatesChristian Cleberg2026-03-252-1/+35
|
* add 1kb roguelikeChristian Cleberg2026-03-251-2/+6
|
* add 1kb roguelikeChristian Cleberg2026-03-231-0/+20
|
* add gramps and update cleberg.net security headersChristian Cleberg2026-03-222-0/+21
|
* flip a few services to localhostChristian Cleberg2026-03-084-23/+4
|
* add tor onion addresses back inChristian Cleberg2026-03-0428-23/+136
|
generated by cgit v1.2.3 (git 2.39.1) at 2026-08-04 14:53:01 +0000