Publish ITWorx Pulse source

2026-09-03 02:09:19 +02:00
commit bd774932d5
614 changed files with 77116 additions and 0 deletions
@@ -0,0 +1,87 @@
+pid /tmp/nginx.pid;
+error_log /dev/stderr warn;
+events { worker_connections 256; }
+http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+    access_log /dev/stdout;
+    sendfile on;
+    client_body_temp_path /tmp/client_temp;
+    proxy_temp_path /tmp/proxy_temp;
+    fastcgi_temp_path /tmp/fastcgi_temp;
+    uwsgi_temp_path /tmp/uwsgi_temp;
+    scgi_temp_path /tmp/scgi_temp;
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        '' close;
+    }
+
+server {
+    listen 8080;
+    server_name _;
+    root /usr/share/nginx/html;
+    index index.html;
+
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "DENY" always;
+    add_header Referrer-Policy "no-referrer" always;
+    add_header Content-Security-Policy "default-src 'self'; connect-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self'" always;
+    add_header Permissions-Policy "camera=(), geolocation=(), microphone=(), payment=()" always;
+    # Defence-in-depth per SECURITY_THREAT_MODEL.md §4 ("HSTS when HTTPS
+    # deployment is stable"). TLS terminates at the external Nginx Proxy
+    # Manager (ADR-0010); this container only ever serves plain HTTP on
+    # 8080. Browsers ignore Strict-Transport-Security on a non-HTTPS
+    # response, so emitting it here unconditionally is safe even before/if
+    # this service is ever reached directly over HTTP, and it still reaches
+    # the browser once NPM proxies the HTTPS response through unless NPM is
+    # configured to strip it (verify during deployment smoke test, see
+    # docs/operations/DEPLOYMENT_UNRAID.md §7). `includeSubDomains` is set;
+    # `preload` is intentionally omitted because preload-list submission is
+    # effectively irreversible and should only be added once the HTTPS/DNS
+    # setup at the NPM edge has been stable in production for a while.
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+
+    location = /healthz {
+        access_log off;
+        default_type text/plain;
+        return 200 "ok\n";
+    }
+    # Never let conventional internal-observability paths fall through to the
+    # SPA with a misleading HTTP 200. Pulse exposes bounded authenticated
+    # diagnostics below /api/v1/system/*; raw metrics/debug handlers are not a
+    # public web contract.
+    location = /metrics { access_log off; return 404; }
+    location ^~ /debug/ { access_log off; return 404; }
+    # Dependency-aware readiness must reach the API. Without this exact route,
+    # SPA fallback returns index.html with HTTP 200 and monitoring falsely sees
+    # a ready backend even when PostgreSQL or migrations are unavailable.
+    location = /readyz {
+        proxy_pass http://pulse-api:8081;
+        proxy_http_version 1.1;
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+    location /api/ {
+        proxy_pass http://pulse-api:8081;
+        proxy_http_version 1.1;
+        # Preserve a non-default deployment port. The WebSocket library's
+        # same-origin check compares Origin against Host and correctly rejects
+        # a port-stripped Host header.
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        proxy_read_timeout 65s;
+    }
+    location ~ ^/(auth|session)/ {
+        proxy_pass http://pulse-api:8081;
+        proxy_http_version 1.1;
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+    location / { try_files $uri $uri/ /index.html; }
+}
+}