colin
/
resume
1
0
Fork 1
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update docker/resume/nginx.conf
ci/woodpecker/push/woodpecker Pipeline failed Details

This commit is contained in:
colin 2025-03-30 21:28:01 -04:00
parent de1f9d3364
commit 79c5a6d935
1 changed files with 33 additions and 48 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

81
docker/resume/nginx.conf
View File

@ -1,53 +1,38 @@
# Use $request_id as a pseudo-nonce for Content Security Policy (CSP)
map $request_id $nonce {
default "$request_id";
}
server {
listen 8080;
root /usr/share/nginx/html;
index resume.html;
:8080 {
root * .
file_server
encode gzip
# Security headers
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), accelerometer=(), gyroscope=(), magnetometer=(), payment=(), usb=()" always;
# Updated Content Security Policy (CSP) with 'unsafe-inline' temporarily for style-src
add_header Content-Security-Policy "
default-src 'none';
script-src 'self' 'nonce-$nonce' https://matomo.nixc.us https://gist.github.com https://assets-cdn.github.com;
style-src 'self' 'nonce-$nonce' https://colinknapp.com https://getbootstrap.com https://fonts.googleapis.com 'unsafe-inline';
img-src 'self' https://matomo.nixc.us https://colinknapp.com https://hedgedoc.nixc.us https://assets-cdn.github.com https://github.com https://forkaweso.me https://ionicons.com https://twitter.com data:;
font-src 'self' https://fonts.gstatic.com https://github.com https://forkaweso.me data:;
connect-src 'self' https://matomo.nixc.us;
frame-ancestors 'self';
base-uri 'self';
form-action 'self';
" always;
# Cross-origin isolation headers
add_header Cross-Origin-Embedder-Policy "require-corp" always;
add_header Cross-Origin-Resource-Policy "same-origin" always;
add_header Cross-Origin-Opener-Policy "same-origin" always;
# Apply CORP header for the apple-touch-icon to allow cross-origin access
location /icons/apple-touch-icon.png {
add_header Cross-Origin-Resource-Policy "cross-origin";
header {
# HSTS
Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
# Basic security headers
X-Frame-Options "SAMEORIGIN"
X-Content-Type-Options "nosniff"
Referrer-Policy "strict-origin-when-cross-origin"
# Permissions policy
Permissions-Policy "camera=(), microphone=(), geolocation=(), accelerometer=(), gyroscope=(), magnetometer=(), payment=(), usb=()"
# Cross-origin isolation headers
Cross-Origin-Embedder-Policy "require-corp"
Cross-Origin-Resource-Policy "same-origin"
Cross-Origin-Opener-Policy "same-origin"
# Simplified CSP for static content
Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; base-uri 'self'; form-action 'self'"
}
# Use sub_filter to inject the nonce into inline <script> and <style> tags automatically
sub_filter '<script>' '<script nonce="$nonce">';
sub_filter '<style>' '<style nonce="$nonce">';
sub_filter_once off;
sub_filter_types text/html;
# Redirect demo.hedgedoc.org resources to hedgedoc.nixc.us
sub_filter "https://demo.hedgedoc.org" "https://hedgedoc.nixc.us";
location / {
try_files $uri $uri/ =404;
# Handle 404s
handle_errors {
respond "{err.status_code} {err.status_text}"
}
}
# Logging
log {
output stdout
format json
}
}