clawbot
d44c9b60bd
check / check (push) Waiting to run
The Go module moves from backend/ to the root (go.mod, go.sum, .golangci.yml, cmd/, internal/), the page's source to web/, and nginx's two files to configs/. backend/ is gone: its LICENSE and .dockerignore are deleted, and its .gitignore entries, README and scripts are folded into the root ones. script/build builds the server binary after the frontend; script/run and script/clean move up from backend/script/; make test, lint, fmt and fmt-check do what the backend's did. Vite's root is web/ and it still builds into dist/. go.mod ignores node_modules/, whose npm packages can ship .go files. script/bootstrap no longer installs gcc, which only the host Go tests needed. Model: opus-5-5
25 lines
1.4 KiB
Plaintext
25 lines
1.4 KiB
Plaintext
# The security headers REPO_POLICIES.md requires on every response.
|
|
# configs/nginx.conf includes this file, which Dockerfile copies to
|
|
# /etc/nginx/security-headers.conf. always sends each header on error
|
|
# responses too.
|
|
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
|
|
# Scripts and styles load only from the page's own origin. Inline ones
|
|
# are blocked, style attributes in markup included, so style elements
|
|
# through classes or element.style. data: images are for the favicon
|
|
# in web/index.html. connect-src is * because the browser checks each
|
|
# probe in web/src/main.js against it, and also every redirect the probe
|
|
# follows, and several of those hosts redirect to others; a list of
|
|
# hosts here would block those probes. It also covers the reports the
|
|
# page sends to its own origin.
|
|
add_header Content-Security-Policy "default-src 'self'; connect-src *; img-src 'self' data:; object-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'" always;
|
|
|
|
add_header X-Frame-Options DENY always;
|
|
add_header X-Content-Type-Options nosniff always;
|
|
|
|
# The probed hosts are not told where the page is served from.
|
|
add_header Referrer-Policy no-referrer always;
|
|
|
|
add_header Permissions-Policy "accelerometer=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), usb=()" always;
|