kevinveenbirkenbachandClaude Opus 5.5 0986957e52 fix(proxy): strip upstream headers on every proxying location fragment ...

proxy_hide_header is replaced, not merged, by a location that sets its own,
so upstream_strips.conf.j2 only takes effect where a location includes it.
The health locations of web-app-prometheus (/healthz/ready, /_live_probe),
which every standard vhost includes, and the extra locations of
web-app-bluesky (/config, /ipcc) and web-app-opentalk (/v1/, /signaling,
/livekit) proxied without it, so X-Powered-By and the upstream's
Strict-Transport-Security leaked on those paths.

All seven locations now include the strips. A new lint checks every role
template without a server block, i.e. every fragment the front proxy
renders into a vhost, and fails on a proxying location that lacks them.
Templates with their own server block are app-internal nginx configs
behind such a location and stay out of scope.

Closes #1124

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-10-22 10:33:53 +02:00

..

healthz.conf.j2

fix(proxy): strip upstream headers on every proxying location fragment

2026-10-22 10:33:53 +02:00

location.conf.j2

…

locations.conf.j2

…

prometheus.conf.j2

…