coolneng
/
zion
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Compare commits

base: coolneng:bc5c561775112a5cb4220e84ba58c4b7a031abc1
Branches Tags
coolneng:master
...
compare: coolneng:1dcd3fe1a451da86559ed0c2384cb52c2bde5123
Branches Tags
coolneng:master

3 Commits
bc5c561775 ... 1dcd3fe1a4

Author SHA1 Message Date
coolneng 1dcd3fe1a4
Update well-known delegation settings for Matrix 2022-10-23 10:54:47 +02:00
coolneng dc1bb22d9d
Use CSP config only in gitea 2022-10-23 10:53:40 +02:00
coolneng 801bc6f07d
Harden protection against XSS attacks 2022-10-23 10:53:09 +02:00
1 changed files with 16 additions and 9 deletions
Show Stats Expand all files Collapse all files

25
modules/webstack.nix
View File

@ -18,13 +18,12 @@
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains"; add_header Strict-Transport-Security "max-age=31536000; includeSubdomains";
# Minimize information leaked to other domains # Minimize information leaked to other domains
add_header 'Referrer-Policy' 'origin-when-cross-origin'; add_header 'Referrer-Policy' 'strict-origin-when-cross-origin';
# Disable embedding as a frame, except from the same origin
add_header Content-Security-Policy "frame-src git.coolneng.duckdns.org; frame-ancestors git.coolneng.duckdns.org";
# Prevent injection of code in other mime types (XSS Attacks) # Prevent injection of code in other mime types (XSS Attacks)
add_header X-Content-Type-Options nosniff; add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header X-Frame-Options SAMEORIGIN;
# This might create errors # This might create errors
proxy_cookie_path / "/; secure; HttpOnly; SameSite=strict"; proxy_cookie_path / "/; secure; HttpOnly; SameSite=strict";
@ -41,12 +40,13 @@
"rewrite ^/gitea/(.*)$ https://git.coolneng.duckdns.org/$1 last;"; "rewrite ^/gitea/(.*)$ https://git.coolneng.duckdns.org/$1 last;";
"/miniflux/".extraConfig = "/miniflux/".extraConfig =
"rewrite ^/miniflux/(.*)$ https://rss.coolneng.duckdns.org/$1 last;"; "rewrite ^/miniflux/(.*)$ https://rss.coolneng.duckdns.org/$1 last;";
# Delegation for Matrix
"/.well-known/" = { "/.well-known/" = {
alias = "${../well-known}" + "/"; alias = "${../well-known}" + "/";
extraConfig = '' extraConfig = ''
${config.services.nginx.commonHttpConfig} ${config.services.nginx.commonHttpConfig}
add_header Access-Control-Allow-Origin '*'; add_header Access-Control-Allow-Origin '*';
add_header Content-Type application/json; default_type application/json;
''; '';
}; };
}; };
@ -70,7 +70,14 @@
"git.coolneng.duckdns.org" = { "git.coolneng.duckdns.org" = {
enableACME = true; enableACME = true;
forceSSL = true; forceSSL = true;
locations."/".proxyPass = "http://localhost:3000/"; locations."/" = {
proxyPass = "http://localhost:3000/";
extraConfig = ''
${config.services.nginx.commonHttpConfig}
# Disable embedding as a frame, except from the same origin
add_header Content-Security-Policy "frame-src git.coolneng.duckdns.org; frame-ancestors git.coolneng.duckdns.org";
'';
};
}; };
"rss.coolneng.duckdns.org" = { "rss.coolneng.duckdns.org" = {
enableACME = true; enableACME = true;
@ -104,9 +111,9 @@
enableACME = true; enableACME = true;
forceSSL = true; forceSSL = true;
locations."/".root = pkgs.element-web.override { locations."/".root = pkgs.element-web.override {
conf.default_server_config."m.homeserver" = { conf.default_server_config = {
"base_url" = "https://matrix.coolneng.duckdns.org"; "m.homeserver"."base_url" = "https://matrix.coolneng.duckdns.org";
"server_name" = "coolneng.duckdns.org"; "m.identity_server"."base_url" = "https://vector.im";
}; };
}; };
}; };