nobswebdev
adb1d7bca9
Fix Onion-Location on SPA responses behind nginx add_header.
...
Render the header inside location / so it is not dropped by other location headers; remove the ineffective server-level directive.
2026-10-28 23:12:08 +01:00
nobswebdev
b97fcc2b20
Add CSP sandbox on nginx hotlink image responses.
...
Block script in user content when /i/ is opened as a document, e.g. SVG opened in a tab.
2026-10-28 22:38:28 +01:00
nobswebdev
4a534a8007
Add production deployment guide and restrict CORS to development.
...
Document clearnet, TLS, and Tor setup; enable Nest CORS only in development and skip CORS_ORIGINS validation in production.
2026-10-28 22:07:32 +01:00
nobswebdev
915d62f09a
Trust nginx proxy and drop hotlink response headers from Nest.
...
Rate limits use X-Forwarded-For behind prod nginx; hotlink security headers are set on /i/ in nginx only.
2026-10-28 20:56:21 +01:00
nobswebdev
cb37a1e23c
Add prod nginx image with clearnet, onion, and SPA build.
...
Multi-stage frontend embed, envsubst entrypoint for TLS vhosts and upload body limits, shared locations with minimal response headers and zero access logs.
2026-10-28 20:56:21 +01:00
nobswebdev
4385a024a8
Add prod compose and backend production image.
...
Wire postgres, pgadmin, backend, nginx, and tor with nullcart-style layout; document clearnet and onion hostname env vars for deploy.
2026-10-28 20:56:05 +01:00
nobswebdev