projects / nutratech / vps-root.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 5e1334c)
attach stats report on each request; nginx safety headers
authorShane Jaroch <chown_tee@proton.me>
Wed, 21 Jan 2026 20:58:50 +0000 (15:58 -0500)
committerShane Jaroch <chown_tee@proton.me>
Wed, 21 Jan 2026 20:58:50 +0000 (15:58 -0500)
etc/nginx/conf.d/default.dev.conf patch | blob | history
etc/nginx/conf.d/default.prod.conf patch | blob | history
scripts/gen_services_map.py patch | blob | history
scripts/gitweb-simplefrontend/services.html patch | blob | history
scripts/homepage.html patch | blob | history

diff --git a/etc/nginx/conf.d/default.dev.conf b/etc/nginx/conf.d/default.dev.conf
index d3bd2e9c0f9026d364d35bea70a08c2fec025475..306a74772c3ed4ad7229b3b29a23bbdd6e211c00 100644 (file)
--- a/etc/nginx/conf.d/default.dev.conf
+++ b/etc/nginx/conf.d/default.dev.conf
@@ -91,8 +91,6 @@ server {
   # Advertise HTTP/3 availability
   add_header Alt-Svc 'h3=":443"; ma=86400' always;
 
-  client_max_body_size 50m;
-
   # HSTS
   add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
   ssl_trusted_certificate /etc/ssl/private/ca-certs.pem;
@@ -100,6 +98,16 @@ server {
   #ssl_stapling on;
   #ssl_stapling_verify on;
 
+  # Other headers
+  add_header X-Frame-Options "SAMEORIGIN" always; # Prevent clickjacking & iframe embedding
+  add_header X-XSS-Protection "1; mode=block" always; # Legacy protection
+  add_header X-Content-Type-Options "nosniff" always; # Prevent MIME-type sniffing
+  # CSP policy (prevents XSS attacks)
+  add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'" always;
+
+  client_max_body_size 50m;
+  add_header X-Request-Time $request_time always;
+
   # Services Map (Homepage)
   root /var/www;
   index homepage.html;
diff --git a/etc/nginx/conf.d/default.prod.conf b/etc/nginx/conf.d/default.prod.conf
index 0af80c03e4fca55c7fc1e771854c5e2547c223f7..64bd94d6592222f71511ff28c88ffe1b7240fbe0 100644 (file)
--- a/etc/nginx/conf.d/default.prod.conf
+++ b/etc/nginx/conf.d/default.prod.conf
@@ -100,15 +100,24 @@ server {
   # Advertise HTTP/3 availability
   add_header Alt-Svc 'h3=":443"; ma=86400' always;
 
-  client_max_body_size 50m;
-
   # HSTS
   add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+  add_header X-Request-Time $request_time always;
   ssl_trusted_certificate /etc/ssl/private/ca-certs.pem;
   # OCSP stapling (NOTE: Responders disabled by letsencrypt as of Q3 2025)
   #ssl_stapling on;
   #ssl_stapling_verify on;
 
+  # Other headers
+  add_header X-Frame-Options "SAMEORIGIN" always; # Prevent clickjacking & iframe embedding
+  add_header X-XSS-Protection "1; mode=block" always; # Legacy protection
+  add_header X-Content-Type-Options "nosniff" always; # Prevent MIME-type sniffing
+  # CSP policy (prevents XSS attacks)
+  add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'" always;
+
+  client_max_body_size 50m;
+  add_header X-Request-Time $request_time always;
+
   # Services Map (Homepage)
   root /var/www;
   index homepage.html;
diff --git a/scripts/gen_services_map.py b/scripts/gen_services_map.py
index c8bcf3c469e15aa5fa075bc416531d29d0f73286..70265a63d2331fa8756062f8ec6e9cfcbdbc8538 100755 (executable)
--- a/scripts/gen_services_map.py
+++ b/scripts/gen_services_map.py
@@ -38,8 +38,22 @@ HTML_TEMPLATE = """<!DOCTYPE html>
         <p>Built: {build_time} | Services: {service_count}</p>
         <p>Nginx: <span class="ssi">v<!--#echo var="nginx_version"--></span> |
            Served: <span class="ssi"><!--#echo var="date_local"--></span> |
-           Request: <span class="ssi"><!--#echo var="request_uri"--></span></p>
+           Request: <span class="ssi"><!--#echo var="request_uri"--></span> |
+           Latency: <span id="latency" class="ssi">...</span></p>
     </footer>
+    <script>
+    (function() {{
+        // IE11-compatible: use performance.timing (deprecated but widely supported)
+        var timing = window.performance && window.performance.timing;
+        if (timing) {{
+            window.onload = function() {{
+                var latency = timing.responseEnd - timing.requestStart;
+                var el = document.getElementById('latency');
+                if (el) el.textContent = latency + 'ms';
+            }};
+        }}
+    }})();
+    </script>
 </body>
 </html>"""
 
diff --git a/scripts/gitweb-simplefrontend/services.html b/scripts/gitweb-simplefrontend/services.html
index 6616b188271a244add1ed4640f57d67dfa0b4697..a5a1e58c53f35cba1738b1b547cdf76f21fa6650 100644 (file)
--- a/scripts/gitweb-simplefrontend/services.html
+++ b/scripts/gitweb-simplefrontend/services.html
@@ -36,10 +36,24 @@
         </div>
 
     <footer>
-        <p>Built: 2026-01-21 15:51:38  | Services: 3</p>
+        <p>Built: 2026-01-21 15:53:23  | Services: 3</p>
         <p>Nginx: <span class="ssi">v<!--#echo var="nginx_version"--></span> |
            Served: <span class="ssi"><!--#echo var="date_local"--></span> |
-           Request: <span class="ssi"><!--#echo var="request_uri"--></span></p>
+           Request: <span class="ssi"><!--#echo var="request_uri"--></span> |
+           Latency: <span id="latency" class="ssi">...</span></p>
     </footer>
+    <script>
+    (function() {
+        // IE11-compatible: use performance.timing (deprecated but widely supported)
+        var timing = window.performance && window.performance.timing;
+        if (timing) {
+            window.onload = function() {
+                var latency = timing.responseEnd - timing.requestStart;
+                var el = document.getElementById('latency');
+                if (el) el.textContent = latency + 'ms';
+            };
+        }
+    })();
+    </script>
 </body>
 </html>
\ No newline at end of file
diff --git a/scripts/homepage.html b/scripts/homepage.html
index f05c10a5416829b7a346a0cb803e14353093fb3a..b7a1922aafcb3595d49cfd91dab7adaaebd9138f 100644 (file)
--- a/scripts/homepage.html
+++ b/scripts/homepage.html
@@ -51,10 +51,24 @@
         </div>
 
     <footer>
-        <p>Built: 2026-01-21 15:51:38  | Services: 6</p>
+        <p>Built: 2026-01-21 15:53:23  | Services: 6</p>
         <p>Nginx: <span class="ssi">v<!--#echo var="nginx_version"--></span> |
            Served: <span class="ssi"><!--#echo var="date_local"--></span> |
-           Request: <span class="ssi"><!--#echo var="request_uri"--></span></p>
+           Request: <span class="ssi"><!--#echo var="request_uri"--></span> |
+           Latency: <span id="latency" class="ssi">...</span></p>
     </footer>
+    <script>
+    (function() {
+        // IE11-compatible: use performance.timing (deprecated but widely supported)
+        var timing = window.performance && window.performance.timing;
+        if (timing) {
+            window.onload = function() {
+                var latency = timing.responseEnd - timing.requestStart;
+                var el = document.getElementById('latency');
+                if (el) el.textContent = latency + 'ms';
+            };
+        }
+    })();
+    </script>
 </body>
 </html>
\ No newline at end of file
Unnamed repository; edit this file 'description' to name the repository.