The_Great_Archive/cryptpad
1
0
Fork 0
mirror of https://github.com/cryptpad/cryptpad.git synced 2026-09-14 11:05:41 +05:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2005 from nisbet-hubbard/patch-7

Browse Source 
Performance improvements (2/3) to example-advanced.nginx.conf
This commit is contained in:
Mathilde 2025-10-22 11:14:54 +02:00 committed by GitHub
commit de2e740d7a
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 88 additions and 42 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

98
docs/example-advanced.nginx.conf
View File

@ -92,15 +92,11 @@ server {
# OnlyOffice fonts may be loaded from both domains
if ($uri ~ ^/common/onlyoffice/.*/fonts/) { set $allowed_origins "*"; }
add_header X-XSS-Protection "1; mode=block";
add_header X-Content-Type-Options nosniff;
add_header Access-Control-Allow-Origin "${allowed_origins}";
add_header Access-Control-Allow-Credentials true;
# add_header X-Frame-Options "SAMEORIGIN";
# Opt out of Google's FLoC Network
add_header Permissions-Policy interest-cohort=();
# Enable SharedArrayBuffer in Firefox (for .xlsx export)
add_header Cross-Origin-Resource-Policy cross-origin;
add_header Cross-Origin-Embedder-Policy require-corp;
@ -185,9 +181,6 @@ server {
set $scriptSrc "'self' 'unsafe-eval' 'unsafe-inline' resource: https://${main_domain}";
}
# Finally, set all the rules you composed above.
add_header Content-Security-Policy "default-src 'none'; child-src $childSrc; worker-src $workerSrc; media-src $mediaSrc; style-src $styleSrc; script-src $scriptSrc; connect-src $connectSrc; font-src $fontSrc; img-src $imgSrc; frame-src $frameSrc; frame-ancestors $frameAncestors";
# Add support for .mjs files used by pdfjs
types {
application/javascript mjs;
@ -211,16 +204,78 @@ server {
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection upgrade;
# HSTS (ngx_http_headers_module is required) (63072000 seconds)
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
add_header X-Content-Type-Options nosniff;
add_header Access-Control-Allow-Origin "${allowed_origins}";
add_header Access-Control-Allow-Credentials true;
# add_header X-Frame-Options "SAMEORIGIN";
# Enable SharedArrayBuffer in Firefox (for .xlsx export)
add_header Cross-Origin-Resource-Policy cross-origin always;
add_header Cross-Origin-Embedder-Policy require-corp always;
add_header Referrer-Policy same-origin;
# Will not set any header if it is emptystring
add_header Cache-Control $cacheControl;
# Set all the rules you composed above.
add_header Content-Security-Policy "default-src 'none'; child-src $childSrc; worker-src $workerSrc; media-src $mediaSrc; style-src $styleSrc; script-src $scriptSrc; connect-src $connectSrc; font-src $fontSrc; img-src $imgSrc; frame-src $frameSrc; frame-ancestors $frameAncestors" always;
}
location ^~ /customize.dist/ {
# This is needed in order to prevent infinite recursion between /customize/ and the root
if ($uri ~ ^/.*\.html) {
# HSTS (ngx_http_headers_module is required) (63072000 seconds)
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
add_header X-Content-Type-Options nosniff;
add_header Access-Control-Allow-Origin "${allowed_origins}";
add_header Access-Control-Allow-Credentials true;
# add_header X-Frame-Options "SAMEORIGIN";
# Enable SharedArrayBuffer in Firefox (for .xlsx export)
add_header Cross-Origin-Resource-Policy cross-origin always;
add_header Cross-Origin-Embedder-Policy require-corp always;
add_header Referrer-Policy same-origin;
# Will not set any header if it is emptystring
add_header Cache-Control $cacheControl;
# Set all the rules you composed above.
add_header Content-Security-Policy "default-src 'none'; child-src $childSrc; worker-src $workerSrc; media-src $mediaSrc; style-src $styleSrc; script-src $scriptSrc; connect-src $connectSrc; font-src $fontSrc; img-src $imgSrc; frame-src $frameSrc; frame-ancestors $frameAncestors" always;
}
}
# try to load customizeable content via /customize/ and fall back to the default content
# located at /customize.dist/
# This is what allows you to override behaviour.
location ^~ /customize/ {
rewrite ^/customize/(.*)$ $1 break;
if ($uri ~ ^/.*\.html) {
# HSTS (ngx_http_headers_module is required) (63072000 seconds)
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
add_header X-Content-Type-Options nosniff;
add_header Access-Control-Allow-Origin "${allowed_origins}";
add_header Access-Control-Allow-Credentials true;
# add_header X-Frame-Options "SAMEORIGIN";
# Enable SharedArrayBuffer in Firefox (for .xlsx export)
add_header Cross-Origin-Resource-Policy cross-origin always;
add_header Cross-Origin-Embedder-Policy require-corp always;
add_header Referrer-Policy same-origin;
# Will not set any header if it is emptystring
add_header Cache-Control $cacheControl;
# Set all the rules you composed above.
add_header Content-Security-Policy "default-src 'none'; child-src $childSrc; worker-src $workerSrc; media-src $mediaSrc; style-src $styleSrc; script-src $scriptSrc; connect-src $connectSrc; font-src $fontSrc; img-src $imgSrc; frame-src $frameSrc; frame-ancestors $frameAncestors" always;
}
try_files /customize/$uri /customize.dist/$uri;
}
@ -299,8 +354,6 @@ server {
# so we hide them
proxy_hide_header 'X-Content-Type-Options';
proxy_hide_header 'Access-Control-Allow-Origin';
proxy_hide_header 'Permissions-Policy';
proxy_hide_header 'X-XSS-Protection';
proxy_hide_header 'Cross-Origin-Resource-Policy';
proxy_hide_header 'Cross-Origin-Embedder-Policy';
proxy_pass http://localhost:3000;
@ -314,5 +367,30 @@ server {
}
# Finally, serve anything the above exceptions don't govern.
try_files /customize/www/$uri /customize/www/$uri/index.html /src/$uri /www/$uri /www/$uri/index.html /src/$uri /customize/$uri;
location ~* \.(css|js|mjs|png|svg|gif|ico|woff|woff2|eot|otf|ttf|cur|map)$ {
try_files /customize/www/$uri /customize/www/$uri/index.html /src/$uri /www/$uri /www/$uri/index.html /src/$uri /customize/$uri;
}
location / {
# HSTS (ngx_http_headers_module is required) (63072000 seconds)
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
add_header X-Content-Type-Options nosniff;
add_header Access-Control-Allow-Origin "${allowed_origins}";
add_header Access-Control-Allow-Credentials true;
# add_header X-Frame-Options "SAMEORIGIN";
# Enable SharedArrayBuffer in Firefox (for .xlsx export)
add_header Cross-Origin-Resource-Policy cross-origin always;
add_header Cross-Origin-Embedder-Policy require-corp always;
add_header Referrer-Policy same-origin;
# Will not set any header if it is emptystring
add_header Cache-Control $cacheControl;
# Set all the rules you composed above.
add_header Content-Security-Policy "default-src 'none'; child-src $childSrc; worker-src $workerSrc; media-src $mediaSrc; style-src $styleSrc; script-src $scriptSrc; connect-src $connectSrc; font-src $fontSrc; img-src $imgSrc; frame-src $frameSrc; frame-ancestors $frameAncestors" always;
try_files /customize/www/$uri /customize/www/$uri/index.html /src/$uri /www/$uri /www/$uri/index.html /src/$uri /customize/$uri;
}
}

32
www/checkup/main.js
View File

@ -448,38 +448,6 @@ define([
});
}
assert(function (cb, msg) {
setWarningClass(msg);
var printMessage = function (value) {
msg.appendChild(h('span', [
"This instance hasn't opted out of participation in Google's ",
code('FLoC'),
" targeted advertizing network. ",
"This can be done by setting a ",
code('permissions-policy'),
" HTTP header with a value of ",
code('"interest-cohort=()"'),
" in the configuration of its reverse proxy instead of the current value (",
code(value),
"). See the provided NGINX configuration file for an example. ",
h('p', [
link("https://www.eff.org/deeplinks/2021/04/am-i-floced-launch", 'Learn more'),
]),
]));
};
Tools.common_xhr('/', function (xhr) {
var header = xhr.getResponseHeader('permissions-policy') || '';
var rules = header.split(',');
if (rules.includes('interest-cohort=()')) { return void cb(true); }
printMessage(JSON.stringify(header));
cb(header);
});
});
assert(function (cb, msg) {
msg.appendChild(h('span', [
code('/api/broadcast'),