mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 03:38:23 +00:00
kevinveenbirkenbachandClaude Opus 5.5
0986957e52
proxy_hide_header is replaced, not merged, by a location that sets its own, so upstream_strips.conf.j2 only takes effect where a location includes it. The health locations of web-app-prometheus (/healthz/ready, /_live_probe), which every standard vhost includes, and the extra locations of web-app-bluesky (/config, /ipcc) and web-app-opentalk (/v1/, /signaling, /livekit) proxied without it, so X-Powered-By and the upstream's Strict-Transport-Security leaked on those paths. All seven locations now include the strips. A new lint checks every role template without a server block, i.e. every fragment the front proxy renders into a vhost, and fails on a proxying location that lacks them. Templates with their own server block are app-internal nginx configs behind such a location and stay out of scope. Closes #1124 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
36 lines
1.7 KiB
Django/Jinja
36 lines
1.7 KiB
Django/Jinja
# Injected by web-app-bluesky (same pattern as web-app-yourls).
|
|
# Exposes a same-origin /config to avoid CORS when the social-app
|
|
# fetches config. The `resolver` + variable form below is required so
|
|
# nginx defers DNS for the public `ip.bsky.app` / `bsky.app`
|
|
# upstreams to runtime — without it `nginx -t` refuses to start
|
|
# because the openresty container can't resolve those hosts at
|
|
# config-load time.
|
|
location = /config {
|
|
resolver {{ NETWORK_PUBLIC_DNS_RESOLVERS | join(' ') }} ipv6={{ NETWORK_IPV6_ENABLED | on_off }} valid=300s;
|
|
set $up_host "{{ BLUESKY_CONFIG_UPSTREAM_URL | regex_replace('^https?://', '') | regex_replace('/.*$', '') }}";
|
|
set $bluesky_config_upstream "{{ BLUESKY_CONFIG_UPSTREAM_URL }}";
|
|
proxy_pass $bluesky_config_upstream;
|
|
{% include 'roles/sys-svc-proxy/templates/headers/upstream_strips.conf.j2' %}
|
|
proxy_set_header Host $up_host;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Connection "";
|
|
proxy_ssl_server_name on;
|
|
|
|
proxy_hide_header Access-Control-Allow-Origin;
|
|
{% include 'roles/sys-svc-proxy/templates/headers/access_control_allow.conf.j2' %}
|
|
}
|
|
|
|
location = /ipcc {
|
|
resolver {{ NETWORK_PUBLIC_DNS_RESOLVERS | join(' ') }} ipv6={{ NETWORK_IPV6_ENABLED | on_off }} valid=300s;
|
|
set $up_host "bsky.app";
|
|
set $bluesky_ipcc_upstream "https://bsky.app/ipcc";
|
|
proxy_pass $bluesky_ipcc_upstream;
|
|
{% include 'roles/sys-svc-proxy/templates/headers/upstream_strips.conf.j2' %}
|
|
proxy_set_header Host $up_host;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Connection "";
|
|
proxy_ssl_server_name on;
|
|
proxy_hide_header Access-Control-Allow-Origin;
|
|
{% include 'roles/sys-svc-proxy/templates/headers/access_control_allow.conf.j2' %}
|
|
}
|