summaryrefslogtreecommitdiff
path: root/linux
Commit message (Collapse)AuthorAgeFilesLines
* nginx: enforce piped CSP, drop dead freshrss CSP and rss vhostChristian Cleberg2 days4-52/+14
| | | | | | | | | | | | | | | | | | | | | | Promote piped.krz.sh from Content-Security-Policy-Report-Only to enforcing. Validated in a real browser first: homepage, VOD playback and seek on two videos, channel page and a 39-result search were all clean, and every host contacted was already allowed (self, pipedapi, pipedproxy, blob:). No fallback to pipedproxy.kavin.rocks, so viewer IPs stay on the self-hosted proxy. The check was proven meaningful before being trusted by injecting a disallowed image and confirming a securitypolicyviolation with disposition "report". Remove the FreshRSS CSP (include file plus the $csp_freshrss map). The header never reached a browser: rss.krz.sh is routed tunnel-direct to the container on :8099 and never transits nginx. Promoting it would also have regressed behaviour rather than hardened it, since browsers enforce the intersection of stacked policies and this one was stricter than FreshRSS's own exactly where feed content lives (no blob: in img-src, no * in media-src/frame-src). FreshRSS keeps its own, correctly RSS-aware, policy. Delete conf.d/rss.conf entirely. It was unreachable: no onion targets :10045, no other vhost uses the port, and rss.zerolabs.sh is redirected to rss.krz.sh at the Cloudflare edge before the origin is reached.
* fix security headers for new vhostsChristian Cleberg2 days5-2/+52
|
* add i.confChristian Cleberg2 days1-0/+9
|
* revamp security headers and site confsChristian Cleberg2 days21-90/+239
|
* chore: cleanupChristian Cleberg3 days2-1/+87
|
* chore: cleanupChristian Cleberg3 days28-244/+62
|
* fix krz.sh.confChristian Cleberg3 days1-0/+8
|
* add git.confChristian Cleberg3 days1-0/+91
|
* update rogueChristian Cleberg3 days2-12/+12
|
* remove autheliaChristian Cleberg4 days2-38/+0
|
* fix: format latest nginx conf changesChristian Cleberg2026-05-101-133/+37
|
* fix: format latest nginx conf changesChristian Cleberg2026-05-101-48/+39
|
* fix: add redirect file cleberg.netChristian Cleberg2026-05-102-1/+140
|
* fix: 404 for .well-known to reduce warningsChristian Cleberg2026-05-101-4/+5
|
* fix: ensure port doesn't leak during slash redirectsChristian Cleberg2026-05-101-0/+1
|
* remove stray fileChristian Cleberg2026-05-011-38/+0
|
* fix: enable markdown serving via org on cleberg.netChristian Cleberg2026-05-011-10/+1
|
* fix: enable markdown serving via org on cleberg.netChristian Cleberg2026-05-012-5/+53
|
* migrate docker from nginx to cloudflared tunnelChristian Cleberg2026-04-303-153/+1
|
* migrate docker from nginx to cloudflared tunnelChristian Cleberg2026-04-3031-533/+6
|
* remove authChristian Cleberg2026-04-308-32/+0
|
* update backendsChristian Cleberg2026-04-301-0/+3
|
* Add cleberg.net canonical redirects for zerolabs subdomainsChristian Cleberg2026-04-3045-868/+208
|
* move zerolabs to local port, remove authelia from irc, and update ↵Christian Cleberg2026-04-304-20/+25
| | | | cleberg.net logging
* fix timeout for bb.zerolabs.shChristian Cleberg2026-04-182-2/+6
|
* add bb.zerolabs.shChristian Cleberg2026-04-181-0/+23
|
* fix IP address mappingsChristian Cleberg2026-04-151-2/+2
|
* fix IP address mappingsChristian Cleberg2026-04-151-18/+18
|
* remove rimgoChristian Cleberg2026-04-151-39/+0
|
* increase hash sizeChristian Cleberg2026-04-151-4/+4
|
* increase hash sizeChristian Cleberg2026-04-151-0/+4
|
* rework nginx structureChristian Cleberg2026-04-1553-354/+392
|
* fix nginx warningsChristian Cleberg2026-04-152-39/+15
|
* fix duplicate .cleberg.net issueChristian Cleberg2026-04-152-6/+3
|
* remove IPv6 listenersChristian Cleberg2026-04-1545-141/+1
|
* fix: resolve multiple server names in default.conf and multiple 443 blocks in aoChristian Cleberg2026-04-153-31/+6
|
* redirect hutch to zerolabs.shChristian Cleberg2026-04-101-0/+22
|
* migrate service URIs to zerolabs.shChristian Cleberg2026-04-0937-163/+204
|
* add zerolabs.shChristian Cleberg2026-04-0940-46/+856
|
* Revert "add zerolabs.sh"Christian Cleberg2026-04-092-70/+0
| | | | This reverts commit 6624038ba7e8332350976104449e5dc4a623766d.
* add zerolabs.shChristian Cleberg2026-04-092-0/+70
|
* fix CSP for img.cleberg.netChristian Cleberg2026-04-081-1/+9
|
* add authelia to btChristian Cleberg2026-03-261-5/+5
|
* conf updatesChristian Cleberg2026-03-252-1/+35
|
* add 1kb roguelikeChristian Cleberg2026-03-251-2/+6
|
* add 1kb roguelikeChristian Cleberg2026-03-231-0/+20
|
* add gramps and update cleberg.net security headersChristian Cleberg2026-03-222-0/+21
|
* flip a few services to localhostChristian Cleberg2026-03-084-23/+4
|
* add tor onion addresses back inChristian Cleberg2026-03-0428-23/+136
|
* remove old configsChristian Cleberg2026-03-045-87/+0
|
generated by cgit v1.2.3 (git 2.39.1) at 2026-08-05 18:50:12 +0000