37 lines
1.9 KiB
Nginx Configuration File
37 lines
1.9 KiB
Nginx Configuration File
worker_processes auto;
|
|
pid /tmp/nginx.pid;
|
|
error_log /dev/stderr warn;
|
|
events { worker_connections 256; }
|
|
http {
|
|
include /etc/nginx/mime.types;
|
|
types { application/javascript mjs; }
|
|
default_type application/octet-stream;
|
|
access_log off;
|
|
server_tokens off;
|
|
client_body_temp_path /tmp/client_temp;
|
|
proxy_temp_path /tmp/proxy_temp;
|
|
fastcgi_temp_path /tmp/fastcgi_temp;
|
|
uwsgi_temp_path /tmp/uwsgi_temp;
|
|
scgi_temp_path /tmp/scgi_temp;
|
|
server {
|
|
listen 8080;
|
|
root /usr/share/nginx/html;
|
|
absolute_redirect off;
|
|
add_header X-Content-Type-Options nosniff always;
|
|
add_header Referrer-Policy no-referrer always;
|
|
add_header Cache-Control "no-cache, no-store, must-revalidate" always;
|
|
# Delegation by the parent is additionally required for framed capture.
|
|
add_header Permissions-Policy "camera=(self), microphone=(self), display-capture=(self), picture-in-picture=(self), geolocation=(), payment=(), usb=(), serial=()" always;
|
|
# The broker is on the same node at a different port. It validates its
|
|
# parent independently. Keep script execution same-origin, without eval.
|
|
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; media-src 'self' blob: mediastream:; connect-src 'self' wss: https:; worker-src 'self'; frame-src 'self' http: https:; font-src 'self'; object-src 'none'; base-uri 'none'; form-action 'none'" always;
|
|
location = / { return 302 /j/; }
|
|
location = /j { return 308 /j/; }
|
|
location = /healthz { try_files /j/index.html =503; }
|
|
location = /nostr-provider.js { alias /bridge/nostr-provider.js; }
|
|
location /j/ { try_files $uri $uri/ =404; }
|
|
# No pretend success for missing TURN, meeting-code or upload services.
|
|
location / { return 404; }
|
|
}
|
|
}
|