sourcehut
/
sr.ht-nginx
mirror of https://git.sr.ht/~sircmpwn/sr.ht-nginx
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Include common headers from separate file 

This commit brings back all headers previously defined in port443.conf.
The current setup has been missing them since the `add_header` directive
was added to the individual `location` blocks (for CSP). The nginx
manual states:

> These directives are inherited from the previous configuration level
> if and only if there are no add_header directives defined on the
> current level

http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header

None of the headers are important enough that they would have to be
added to all possible `location` blocks. Adding them to the root block
for each site will be sufficient.
This commit is contained in:
Conrad Hoffmann 2022-03-14 19:20:26 +01:00 committed by Drew DeVault
parent 305e2a56cf
commit 5300cf2efa
13 changed files with 15 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
builds.sr.ht.conf
View File

@ -14,6 +14,7 @@ server {
location / {
proxy_pass http://127.0.0.1:5002;
include headers.conf;
add_header Content-Security-Policy "default-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; script-src 'self' 'unsafe-inline'" always;
include web.conf;
}

1
chat.sr.ht.conf
View File

@ -19,6 +19,7 @@ server {
}
root /usr/share/webapps/gamja;
include headers.conf;
# We have to use a weird connect-src because of a Safari bug
# https://bugs.webkit.org/show_bug.cgi?id=201591
add_header Content-Security-Policy "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; connect-src wss://chat.sr.ht https://chat.sr.ht" always;

1
dispatch.sr.ht.conf
View File

@ -12,6 +12,7 @@ server {
location / {
proxy_pass http://127.0.0.1:5005;
include headers.conf;
add_header Content-Security-Policy "default-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; script-src 'self'" always;
include web.conf;
}

1
git.sr.ht.conf
View File

@ -14,6 +14,7 @@ server {
location / {
proxy_pass http://127.0.0.1:5001;
include headers.conf;
add_header Content-Security-Policy "default-src 'none'; style-src 'self' 'unsafe-inline'; img-src * data:; script-src 'self' 'unsafe-inline'" always;
include web.conf;
}

4
headers.conf Normal file
View File

@ -0,0 +1,4 @@
add_header X-Clacks-Overhead "GNU Terry Pratchett";
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
# Fuck you, Google, I don't spy on my users
add_header Permissions-Policy interest-cohort=();

1
hg.sr.ht.conf
View File

@ -14,6 +14,7 @@ server {
location / {
proxy_pass http://127.0.0.1:5010;
include headers.conf;
add_header Content-Security-Policy "default-src 'none'; style-src 'self' 'unsafe-inline'; img-src * data:; script-src 'self' 'unsafe-inline'" always;
include web.conf;
}

1
hub.sr.ht.conf
View File

@ -17,6 +17,7 @@ server {
location / {
proxy_pass http://127.0.0.1:5014;
include headers.conf;
add_header Content-Security-Policy "default-src 'none'; style-src 'self' 'unsafe-inline'; img-src * data:; script-src 'self'" always;
include web.conf;
}

1
lists.sr.ht.conf
View File

@ -13,6 +13,7 @@ server {
location / {
proxy_pass http://127.0.0.1:5006;
include headers.conf;
add_header Content-Security-Policy "default-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; script-src 'self' 'unsafe-inline'";
include web.conf;
}

1
man.sr.ht.conf
View File

@ -14,6 +14,7 @@ server {
location / {
proxy_pass http://127.0.0.1:5004;
include headers.conf;
add_header Content-Security-Policy "default-src 'none'; style-src 'self' 'unsafe-inline'; img-src * data:; script-src 'self'" always;
include web.conf;
}

1
meta.sr.ht.conf
View File

@ -12,6 +12,7 @@ server {
location / {
proxy_pass http://127.0.0.1:5000;
include headers.conf;
add_header Content-Security-Policy "default-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; script-src 'self' 'unsafe-inline' *.stripe.com *.stripe.network; frame-src *.stripe.com *.stripe.network" always;
include web.conf;
}

1
paste.sr.ht.conf
View File

@ -14,6 +14,7 @@ server {
location / {
proxy_pass http://127.0.0.1:5011;
include headers.conf;
add_header Content-Security-Policy "default-src 'none'; style-src 'self' 'unsafe-inline'; img-src * data:; script-src 'self' 'unsafe-inline'" always;
include web.conf;
}

5
port443.conf
View File

@ -1,11 +1,6 @@
listen 443 ssl http2;
listen [::]:443 ssl http2;
add_header X-Clacks-Overhead "GNU Terry Pratchett";
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
# Fuck you, Google, I don't spy on my users
add_header Permissions-Policy interest-cohort=();
gzip on;
gzip_types text/css text/html;

1
todo.sr.ht.conf
View File

@ -14,6 +14,7 @@ server {
location / {
proxy_pass http://127.0.0.1:5003;
include headers.conf;
add_header Content-Security-Policy "default-src 'none'; style-src 'self' 'unsafe-inline'; img-src * data:; script-src 'self' 'unsafe-inline'" always;
include web.conf;
}