mirror of
https://github.com/penpot/penpot.git
synced 2026-09-19 10:26:14 +00:00
3cdf86a253
The three locations of nginx-external-locations.conf define their own add_header directives, which under nginx's inheritance rules discards every add_header from the enclosing server block. They were therefore served without any of the four security headers already shipped, and would equally have been served without the new CSP and HSTS ones. Include the common file in all three, which is the pattern the development environment already follows for the equivalent locations. Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net>
63 lines
2.3 KiB
Plaintext
63 lines
2.3 KiB
Plaintext
location ~ ^/github/penpot-files/(.+)$ {
|
|
rewrite ^/github/penpot-files/(.+) /penpot/penpot-files/refs/heads/main/$1 break;
|
|
proxy_pass https://raw.githubusercontent.com;
|
|
|
|
proxy_hide_header Access-Control-Allow-Origin;
|
|
proxy_hide_header Cookies;
|
|
proxy_set_header User-Agent "curl/8.5.0";
|
|
proxy_set_header Host "raw.githubusercontent.com";
|
|
proxy_set_header Accept "*/*";
|
|
include /etc/nginx/nginx-security-headers.conf;
|
|
add_header Access-Control-Allow-Origin $http_origin;
|
|
proxy_buffering off;
|
|
}
|
|
|
|
location ~ ^/internal/gfonts/font/(?<font_file>.+) {
|
|
proxy_pass https://fonts.gstatic.com/s/$font_file;
|
|
|
|
proxy_hide_header Access-Control-Allow-Origin;
|
|
proxy_hide_header Cross-Origin-Resource-Policy;
|
|
proxy_hide_header Link;
|
|
proxy_hide_header Alt-Svc;
|
|
proxy_hide_header Cache-Control;
|
|
proxy_hide_header Expires;
|
|
proxy_hide_header Cross-Origin-Opener-Policy;
|
|
proxy_hide_header Report-To;
|
|
|
|
proxy_ignore_headers Set-Cookie Vary Cache-Control Expires;
|
|
|
|
proxy_set_header User-Agent "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36";
|
|
proxy_set_header Host "fonts.gstatic.com";
|
|
proxy_set_header Accept "*/*";
|
|
|
|
proxy_cache penpot;
|
|
|
|
include /etc/nginx/nginx-security-headers.conf;
|
|
add_header Access-Control-Allow-Origin $http_origin;
|
|
add_header Cache-Control max-age=86400;
|
|
add_header X-Cache-Status $upstream_cache_status;
|
|
}
|
|
|
|
location ~ ^/internal/gfonts/css {
|
|
proxy_pass https://fonts.googleapis.com/css?$args;
|
|
proxy_hide_header Access-Control-Allow-Origin;
|
|
proxy_hide_header Cross-Origin-Resource-Policy;
|
|
proxy_hide_header Link;
|
|
proxy_hide_header Alt-Svc;
|
|
proxy_hide_header Cache-Control;
|
|
proxy_hide_header Expires;
|
|
|
|
proxy_ignore_headers Set-Cookie Vary Cache-Control Expires;
|
|
|
|
proxy_set_header User-Agent "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36";
|
|
proxy_set_header Host "fonts.googleapis.com";
|
|
proxy_set_header Accept "*/*";
|
|
|
|
proxy_cache penpot;
|
|
|
|
include /etc/nginx/nginx-security-headers.conf;
|
|
add_header Access-Control-Allow-Origin $http_origin;
|
|
add_header Cache-Control max-age=86400;
|
|
add_header X-Cache-Status $upstream_cache_status;
|
|
}
|