Slave/prod deploy #12

2026-10-28T23:22:07Z

nobswebdev commented

2026-10-28 23:22:07 +00:00

No description provided.

nobswebdev added 6 commits 2026-10-28 23:22:08 +00:00

Add prod compose and backend production image. 4385a024a8

Wire postgres, pgadmin, backend, nginx, and tor with nullcart-style layout; document clearnet and onion hostname env vars for deploy.

Add prod nginx image with clearnet, onion, and SPA build. cb37a1e23c

Multi-stage frontend embed, envsubst entrypoint for TLS vhosts and upload body limits, shared locations with minimal response headers and zero access logs.

Trust nginx proxy and drop hotlink response headers from Nest. 915d62f09a

Rate limits use X-Forwarded-For behind prod nginx; hotlink security headers are set on /i/ in nginx only.

Add production deployment guide and restrict CORS to development. 4a534a8007

Document clearnet, TLS, and Tor setup; enable Nest CORS only in development and skip CORS_ORIGINS validation in production.

Add CSP sandbox on nginx hotlink image responses. b97fcc2b20

Block script in user content when /i/ is opened as a document, e.g. SVG opened in a tab.

Fix Onion-Location on SPA responses behind nginx add_header. adb1d7bca9

Render the header inside location / so it is not dropped by other location headers; remove the ineffective server-level directive.

nobswebdev merged commit 80497177f8 into master

2026-10-28 23:22:15 +00:00

nobswebdev deleted branch slave/prod-deploy

2026-10-28 23:22:15 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: nobswebdev/private_image#12