Jens/ModelForge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Initial public ModelForge release

Browse Source
This commit is contained in:
Jens
2026-09-01 21:30:16 +02:00
commit 7082ab955a
490 changed files with 104252 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/security-headers.inc.template
+16
View File
@@ -0,0 +1,16 @@
# Security headers for the ModelForge operator console.
#
# Included in every location because nginx does not inherit `add_header` into a location that
# declares one of its own — setting them once on the server silently dropped them from the entry
# document, which is how M16 found this.
#
# Generated at image build time from VITE_API_BASE_URL: the console's API origin is compiled into
# the bundle, so the policy that protects the bundle is derived from the same value rather than
# maintained separately and allowed to drift.
add_header Content-Security-Policy "default-src 'none'; script-src 'self'; style-src 'self'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self' __API_ORIGIN__; base-uri 'none'; form-action 'self'; frame-ancestors 'none'; object-src 'none'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "no-referrer" always;
add_header Cross-Origin-Opener-Policy "same-origin" always;
add_header Cross-Origin-Resource-Policy "same-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;