Commit `263f281b30`

263f281b30ac0f7daaf654e2e9abee71f9d80709

parent: 3d0c165f49

Verified · cmc

cmc <hello@cleberg.net> · 2026-08-03 17:03 UTC

fix security headers for new vhosts

Layout: unified · split

linux/nginx/etc/nginx/conf.d/i.conf +13

		@@ -1,9 +1,22 @@
1	1	server {
2	2	listen 127.0.0.1:10048;
3	3	server_name i.krz.sh;
	4	add_header Onion-Location "http://j42zbkbxrdx4mvkyutt7jiwpucgcmrdvaelwcwmgwn3mzus2v6x3toad.onion$request_uri" always;
4	5	include custom.d/basic.conf;
5	6	include custom.d/security/content-security-policy.conf;
6	7	root /var/www/i/;
7	8	autoindex on;
8	9	location / { try_files $uri $uri/ =404; }
9	10	}
	11
	12	# Onion counterpart of i.krz.sh. Reached via tor -> 127.0.0.1:10049, so it
	13	# never transits Cloudflare; nginx is the only thing setting headers here.
	14	server {
	15	listen 127.0.0.1:10049;
	16	server_name j42zbkbxrdx4mvkyutt7jiwpucgcmrdvaelwcwmgwn3mzus2v6x3toad.onion;
	17	include custom.d/basic.conf;
	18	include custom.d/security/content-security-policy.conf;
	19	root /var/www/i/;
	20	autoindex on;
	21	location / { try_files $uri $uri/ =404; }
	22	}

linux/nginx/etc/nginx/conf.d/i.conf.bak-i-onion added +9

		@@ -0,0 +1,9 @@
	1	server {
	2	listen 127.0.0.1:10048;
	3	server_name i.krz.sh;
	4	include custom.d/basic.conf;
	5	include custom.d/security/content-security-policy.conf;
	6	root /var/www/i/;
	7	autoindex on;
	8	location / { try_files $uri $uri/ =404; }
	9	}

linux/nginx/etc/nginx/conf.d/krz.sh.conf +1

		@@ -4,5 +4,6 @@ server {
4	4	root /var/www/krz.sh/;
5	5	absolute_redirect off;
6	6	include custom.d/basic.conf;
	7	include custom.d/security/content-security-policy-krz.conf;
7	8	location / { try_files $uri $uri/ =404; }
8	9	}

linux/nginx/etc/nginx/custom.d/http/content_type_maps.conf +19 −2

		@@ -50,7 +50,7 @@ map $sent_http_content_type $x_frame_options {
50	50	# literal newlines, which nginx emitted verbatim -- a folded, malformed header
51	51	# that clients saw as empty. Policies must be ONE line.
52	52	map $sent_http_content_type $content_security_policy {
53		~*text/(html\|javascript)\|application/pdf\|xml "default-src 'self'; img-src 'self' data:; base-uri 'none'; form-action 'self'; frame-ancestors 'none'; object-src 'none'; upgrade-insecure-requests";
	53	~*text/(html\|javascript)\|application/pdf\|xml "default-src 'self'; img-src 'self' data:; base-uri 'none'; form-action 'self'; frame-ancestors 'none'; object-src 'none'";
54	54	}
55	55
56	56	# cleberg.* only. Mirrors what the site actually loads, verified by grepping
		@@ -69,6 +69,23 @@ map $sent_http_content_type $content_security_policy_cmc {
69	69	~*text/(html\|javascript)\|application/pdf\|xml "default-src 'self'; img-src 'self' https://img.cleberg.net data:; script-src 'self' https://bubbles.town; connect-src 'self' https://bubbles.town; style-src 'self' https://cleberg.net; font-src 'self' https://cleberg.net; base-uri 'none'; form-action 'self'; frame-ancestors 'none'; object-src 'none'";
70	70	}
71	71
	72	# krz.sh only. Derived from the served HTML after the img.cleberg.net removal
	73	# (2026-08-03), counted with an HTML parser:
	74	# 14 <img src> -> https://i.krz.sh (the new krz-side image host)
	75	# 12 <link rel=stylesheet> -> https://krz.sh (ABSOLUTE, not relative)
	76	# 12 <link rel=icon> -> https://krz.sh (covered by img-src)
	77	# 0 scripts, inline or external; 0 inline styles.
	78	#
	79	# `https://krz.sh` is listed explicitly because those URLs are absolute: on a
	80	# future krz.sh onion they would be cross-origin and 'self' would block them.
	81	# Same reasoning as the cmc policy above.
	82	#
	83	# script-src stays 'self' rather than 'none': the site ships no scripts today,
	84	# but 'none' would break the first one added, in a way that is easy to misread.
	85	map $sent_http_content_type $content_security_policy_krz {
	86	~*text/(html\|javascript)\|application/pdf\|xml "default-src 'self'; img-src 'self' https://krz.sh https://i.krz.sh data:; style-src 'self' https://krz.sh; font-src 'self' https://krz.sh; script-src 'self'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'; object-src 'none'";
	87	}
	88
72	89	# For apps that ship inline <script>/<style>/style="" and cannot use the strict
73	90	# policy. Currently only office.zerolabs.sh (5 files with inline <script>,
74	91	# 3 with <style>, 2 with style attributes). Identity-neutral -- no host is
		@@ -79,7 +96,7 @@ map $sent_http_content_type $content_security_policy_cmc {
79	96	# strictly worse. The upgrade path is per-file hashes or nonces; that needs
80	97	# changes to the app, not to nginx.
81	98	map $sent_http_content_type $content_security_policy_inline {
82		~*text/(html\|javascript)\|application/pdf\|xml "default-src 'self'; img-src 'self' data:; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'; object-src 'none'; upgrade-insecure-requests";
	99	~*text/(html\|javascript)\|application/pdf\|xml "default-src 'self'; img-src 'self' data:; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'; object-src 'none'";
83	100	}
84	101
85	102	# --- Proxied third-party apps -------------------------------------------

linux/nginx/etc/nginx/custom.d/security/content-security-policy-krz.conf added +10

		@@ -0,0 +1,10 @@
	1	# Content-Security-Policy for krz.sh itself.
	2	#
	3	# Uses $content_security_policy_krz, which names https://i.krz.sh (the krz-side
	4	# image host) and https://krz.sh (its own absolute asset URLs). Both are `krz`
	5	# surfaces, so this stays identity-clean -- it names no `cleberg` host.
	6	#
	7	# Other krz vhosts should use custom.d/security/content-security-policy.conf
	8	# (the strict neutral one); this variant exists only because krz.sh loads
	9	# cross-origin images and uses absolute self-URLs.
	10	add_header Content-Security-Policy $content_security_policy_krz always;

Commit 263f281b30

Commit `263f281b30`