update conf

ita-social-projects · Apr 21, 2023 · f8146dd · f8146dd
1 parent 64da9af
commit f8146dd
Show file tree

Hide file tree

Showing 3 changed files with 34 additions and 63 deletions.
diff --git a/includes/cache.conf b/includes/cache.conf
@@ -1,43 +1,26 @@
+location ~* \.(?:json)$ {
+  add_header        Cache-Control "no-store, no-cache, public, must-revalidate, proxy-revalidate, max-age=0";
+  add_header        Pragma "no-cache";
+  etag              off;
+  if_modified_since off;
+  expires           -1;
+
+  include {{ env "APP_ROOT" }}/includes/security.conf;
+}
+
 location ~* \.(?:css|js)$ {
   add_header        Cache-Control "public, max-age=2628000"; # 1 month
-  ## Security
-  ## Always HTTPS
-  add_header        Strict-Transport-Security "max-age=31449600; includeSubDomains" always; # 1 year
-  ## Don't open in Iframe
-  add_header        X-Frame-Options "DENY" always;
-  ## No content type autodiscovery
-  add_header        X-Content-Type-Options "nosniff" always;
-  ## Don't disclose full url when navigating to links
-  add_header        Referrer-Policy "strict-origin" always;
-  ## New Header for features
-  ## https://www.w3.org/TR/permissions-policy-1/
-  add_header        Permissions-Policy "microphone=(); geolocation=(self); camera=()" always;
-  ## CSP
-  ## TODO: WHEN GOING PROD CHANGE TO Content-Security-Policy
-  add_header        Content-Security-Policy-Report-Only "default-src 'self'; object-src 'none'; style-src 'self' 'unsafe-inline' fonts.googleapis.com; font-src fonts.gstatic.com; script-src 'self'; script-src-elem 'self'; base-uri 'self'; img-src https://* 'self' data:; trusted-types angular; require-trusted-types-for 'script'" always;
+
+  include {{ env "APP_ROOT" }}/includes/security.conf;
 }
 
-# TODO: Should we cache JSON files in assets?
-location ~* \.(?:jpg|jpeg|gif|png|ico|xml|webp|json)$ {
+location ~* \.(?:jpg|jpeg|gif|png|ico|xml|webp|svg)$ {
   add_header        Cache-Control "public, max-age=86400"; # 1 day
-  ## Security
-  ## Always HTTPS
-  add_header        Strict-Transport-Security "max-age=31449600; includeSubDomains" always; # 1 year
-  ## Don't open in Iframe
-  add_header        X-Frame-Options "DENY" always;
-  ## No content type autodiscovery
-  add_header        X-Content-Type-Options "nosniff" always;
-  ## Don't disclose full url when navigating to links
-  add_header        Referrer-Policy "strict-origin" always;
-  ## New Header for features
-  ## https://www.w3.org/TR/permissions-policy-1/
-  add_header        Permissions-Policy "microphone=(); geolocation=(self); camera=()" always;
-  ## CSP
-  ## TODO: WHEN GOING PROD CHANGE TO Content-Security-Policy
-  add_header        Content-Security-Policy-Report-Only "default-src 'self'; object-src 'none'; style-src 'self' 'unsafe-inline' fonts.googleapis.com; font-src fonts.gstatic.com; script-src 'self'; script-src-elem 'self'; base-uri 'self'; img-src https://* 'self' data:; trusted-types angular; require-trusted-types-for 'script'" always;
+
+  include {{ env "APP_ROOT" }}/includes/security.conf;
 }
 
-location ~* \.(?:eot|woff|woff2|ttf|svg|otf) {
+location ~* \.(?:eot|woff|woff2|ttf|otf) {
   add_header        Cache-Control "public, max-age=2628000"; # 1 month
 
   # TODO: Allow CORS requests for fonts?
@@ -50,19 +33,5 @@ location ~* \.(?:eot|woff|woff2|ttf|svg|otf) {
   types     {font/x-woff woff2;}
   types     {image/svg+xml svg svgz;}
 
-  ## Security
-  ## Always HTTPS
-  add_header        Strict-Transport-Security "max-age=31449600; includeSubDomains" always; # 1 year
-  ## Don't open in Iframe
-  add_header        X-Frame-Options "DENY" always;
-  ## No content type autodiscovery
-  add_header        X-Content-Type-Options "nosniff" always;
-  ## Don't disclose full url when navigating to links
-  add_header        Referrer-Policy "strict-origin" always;
-  ## New Header for features
-  ## https://www.w3.org/TR/permissions-policy-1/
-  add_header        Permissions-Policy "microphone=(); geolocation=(self); camera=()" always;
-  ## CSP
-  ## TODO: WHEN GOING PROD CHANGE TO Content-Security-Policy
-  add_header        Content-Security-Policy-Report-Only "default-src 'self'; object-src 'none'; style-src 'self' 'unsafe-inline' fonts.googleapis.com; font-src fonts.gstatic.com; script-src 'self'; script-src-elem 'self'; base-uri 'self'; img-src https://* 'self' data:; trusted-types angular; require-trusted-types-for 'script'" always;
+  include {{ env "APP_ROOT" }}/includes/security.conf;
 }
diff --git a/includes/root.conf b/includes/root.conf
@@ -3,18 +3,5 @@ add_header        Pragma "no-cache";
 etag              off;
 if_modified_since off;
 expires           -1;
-## Security
-## Always HTTPS
-add_header        Strict-Transport-Security "max-age=31449600; includeSubDomains" always; # 1 year
-## Don't open in Iframe
-add_header        X-Frame-Options "DENY" always;
-## No content type autodiscovery
-add_header        X-Content-Type-Options "nosniff" always;
-## Don't disclose full url when navigating to links
-add_header        Referrer-Policy "strict-origin" always;
-## New Header for features
-## https://www.w3.org/TR/permissions-policy-1/
-add_header        Permissions-Policy "microphone=(); geolocation=(self); camera=()" always;
-## CSP
-## TODO: WHEN GOING PROD CHANGE TO Content-Security-Policy
-add_header        Content-Security-Policy-Report-Only "default-src 'self'; object-src 'none'; style-src 'self' 'unsafe-inline' fonts.googleapis.com *.fontawesome.com; font-src fonts.gstatic.com *.fontawesome.com; script-src 'self'; script-src-elem 'self'; base-uri 'self'; img-src https://* 'self' data:; trusted-types angular; require-trusted-types-for 'script'" always;
+
+include {{ env "APP_ROOT" }}/includes/security.conf;
diff --git a/includes/security.conf b/includes/security.conf
@@ -0,0 +1,15 @@
+## Security
+## Always HTTPS
+add_header        Strict-Transport-Security "max-age=31449600; includeSubDomains" always; # 1 year
+## Don't open in Iframe
+add_header        X-Frame-Options "DENY" always;
+## No content type autodiscovery
+add_header        X-Content-Type-Options "nosniff" always;
+## Don't disclose full url when navigating to links
+add_header        Referrer-Policy "strict-origin" always;
+## New Header for features
+## https://www.w3.org/TR/permissions-policy-1/
+add_header        Permissions-Policy "microphone=(); geolocation=(self); camera=()" always;
+## CSP
+## TODO: WHEN GOING PROD CHANGE TO Content-Security-Policy
+add_header        Content-Security-Policy-Report-Only "default-src 'self'; object-src 'none'; style-src 'self' 'unsafe-inline' fonts.googleapis.com *.fontawesome.com; font-src fonts.gstatic.com *.fontawesome.com; script-src 'self'; script-src-elem 'self'; base-uri 'self'; img-src https://* 'self' data:; trusted-types angular; require-trusted-types-for 'script'" always;