mirror of
https://github.com/penpot/penpot.git
synced 2026-11-12 21:10:34 +00:00
84 lines
3.4 KiB
Plaintext
84 lines
3.4 KiB
Plaintext
location ~ ^/github/penpot-files/(.+)$ {
|
|
rewrite ^/github/penpot-files/(.+) /penpot/penpot-files/refs/heads/main/$1 break;
|
|
proxy_pass https://raw.githubusercontent.com;
|
|
|
|
proxy_hide_header Access-Control-Allow-Origin;
|
|
proxy_hide_header Cookies;
|
|
proxy_set_header User-Agent "curl/8.5.0";
|
|
proxy_set_header Host "raw.githubusercontent.com";
|
|
proxy_set_header Accept "*/*";
|
|
# A third-party upstream must not dictate the security policy of our own
|
|
# origin: browsers enforce the intersection of every Content-Security-Policy
|
|
# they receive, and any Strict-Transport-Security lands on this host.
|
|
proxy_hide_header Strict-Transport-Security;
|
|
proxy_hide_header Content-Security-Policy;
|
|
proxy_hide_header Content-Security-Policy-Report-Only;
|
|
|
|
include /etc/nginx/nginx-security-headers.conf;
|
|
add_header Access-Control-Allow-Origin $http_origin;
|
|
proxy_buffering off;
|
|
}
|
|
|
|
location ~ ^/internal/gfonts/font/(?<font_file>.+) {
|
|
proxy_pass https://fonts.gstatic.com/s/$font_file;
|
|
|
|
proxy_hide_header Access-Control-Allow-Origin;
|
|
proxy_hide_header Cross-Origin-Resource-Policy;
|
|
proxy_hide_header Link;
|
|
proxy_hide_header Alt-Svc;
|
|
proxy_hide_header Cache-Control;
|
|
proxy_hide_header Expires;
|
|
proxy_hide_header Cross-Origin-Opener-Policy;
|
|
proxy_hide_header Report-To;
|
|
|
|
proxy_ignore_headers Set-Cookie Vary Cache-Control Expires;
|
|
|
|
proxy_set_header User-Agent "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36";
|
|
proxy_set_header Host "fonts.gstatic.com";
|
|
proxy_set_header Accept "*/*";
|
|
|
|
proxy_cache penpot;
|
|
|
|
# A third-party upstream must not dictate the security policy of our own
|
|
# origin: browsers enforce the intersection of every Content-Security-Policy
|
|
# they receive, and any Strict-Transport-Security lands on this host.
|
|
proxy_hide_header Strict-Transport-Security;
|
|
proxy_hide_header Content-Security-Policy;
|
|
proxy_hide_header Content-Security-Policy-Report-Only;
|
|
|
|
include /etc/nginx/nginx-security-headers.conf;
|
|
add_header Access-Control-Allow-Origin $http_origin;
|
|
add_header Cache-Control max-age=86400;
|
|
add_header X-Cache-Status $upstream_cache_status;
|
|
}
|
|
|
|
location ~ ^/internal/gfonts/css {
|
|
proxy_pass https://fonts.googleapis.com/css?$args;
|
|
proxy_hide_header Access-Control-Allow-Origin;
|
|
proxy_hide_header Cross-Origin-Resource-Policy;
|
|
proxy_hide_header Link;
|
|
proxy_hide_header Alt-Svc;
|
|
proxy_hide_header Cache-Control;
|
|
proxy_hide_header Expires;
|
|
|
|
proxy_ignore_headers Set-Cookie Vary Cache-Control Expires;
|
|
|
|
proxy_set_header User-Agent "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36";
|
|
proxy_set_header Host "fonts.googleapis.com";
|
|
proxy_set_header Accept "*/*";
|
|
|
|
proxy_cache penpot;
|
|
|
|
# A third-party upstream must not dictate the security policy of our own
|
|
# origin: browsers enforce the intersection of every Content-Security-Policy
|
|
# they receive, and any Strict-Transport-Security lands on this host.
|
|
proxy_hide_header Strict-Transport-Security;
|
|
proxy_hide_header Content-Security-Policy;
|
|
proxy_hide_header Content-Security-Policy-Report-Only;
|
|
|
|
include /etc/nginx/nginx-security-headers.conf;
|
|
add_header Access-Control-Allow-Origin $http_origin;
|
|
add_header Cache-Control max-age=86400;
|
|
add_header X-Cache-Status $upstream_cache_status;
|
|
}
|