Jens/geointel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(release): make deployment backup and rollback immutable

Browse Source
This commit is contained in:
Jens
2026-08-30 06:00:43 +02:00
parent a0884d64c9
commit c272220277
47 changed files with 3035 additions and 430 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/unraid/nginx-all-in-one.conf
+43 -2
View File
@@ -1,3 +1,18 @@
geo $geointel_trusted_forwarder {
default 0;
127.0.0.0/8 1;
::1/128 1;
# The outer Nginx Proxy Manager reaches this container through Docker's
# internal bridge; public/LAN clients are not trusted forwarders.
172.16.0.0/12 1;
}
map "$geointel_trusted_forwarder:$http_x_forwarded_proto" $geointel_forwarded_proto {
default $scheme;
"1:https" https;
"1:http" http;
}
server {
listen 80;
server_name _;
@@ -5,21 +20,42 @@ server {
proxy_read_timeout 600s;
proxy_send_timeout 600s;
add_header Content-Security-Policy "frame-ancestors 'none'" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
root /usr/share/nginx/html;
index index.html;
location = /index.html {
add_header Cache-Control "no-cache";
add_header Content-Security-Policy "frame-ancestors 'none'" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
try_files /index.html =404;
}
location = /geointel-icon.svg {
add_header Cache-Control "public, max-age=3600";
add_header Content-Security-Policy "frame-ancestors 'none'" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
try_files /geointel-icon.svg =404;
}
location = /geointel-icon.png {
add_header Cache-Control "public, max-age=3600";
add_header Content-Security-Policy "frame-ancestors 'none'" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
# Preserve the stable DockerMan/public URL while the frontend keeps
# its explicit 32px and 180px icon variants.
try_files /geointel-icon-180.png =404;
@@ -27,6 +63,11 @@ server {
location /assets/ {
add_header Cache-Control "no-cache";
add_header Content-Security-Policy "frame-ancestors 'none'" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
try_files $uri =404;
}
@@ -36,7 +77,7 @@ server {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Proto $geointel_forwarded_proto;
}
location = /health {
@@ -45,7 +86,7 @@ server {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Proto $geointel_forwarded_proto;
}
location = /health/live {