xeno/Portfolio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: align nginx with production smoke gate

Browse Source
This commit is contained in:
LucaP
2026-09-02 11:05:34 +03:00
parent 0119e425ec
commit 259f52a02b
3 changed files with 47 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
scripts/generate-host-config.mjs
View File

@@ -85,7 +85,7 @@ const renderCacheMap = (site, files) => {
].join('\n');
};
const renderAddHeaders = (site, jsonLdCspHash, indent = ' ') => {
const renderAddHeaders = (site, jsonLdCspHash, manifestDigest, indent = ' ') => {
const headers = createSecurityHeaders(site, jsonLdCspHash);
return [
`${indent}add_header Content-Security-Policy "${headers.csp}" always;`,
@@ -94,6 +94,9 @@ const renderAddHeaders = (site, jsonLdCspHash, indent = ' ') => {
`${indent}add_header Permissions-Policy "${headers.permissionsPolicy}" always;`,
`${indent}add_header X-Frame-Options "${headers.frameOptions}" always;`,
`${indent}add_header Cache-Control $portfolio_cache_control always;`,
...(site.environment === 'production'
? [`${indent}add_header X-Portfolio-Manifest-Digest "${manifestDigest}" always;`]
: []),
...(headers.hsts === undefined ? [] : [`${indent}add_header Strict-Transport-Security "${headers.hsts}" always;`]),
...(headers.xRobotsTag === undefined ? [] : [`${indent}add_header X-Robots-Tag "${headers.xRobotsTag}" always;`]),
].join('\n');
@@ -142,6 +145,9 @@ export const renderNginxConfig = (options) => {
const production = site.environment === 'production';
if (production) {
if (typeof options.manifestDigest !== 'string' || !sha256Pattern.test(options.manifestDigest)) {
throw new Error('Production manifest digest must be a lowercase SHA-256 digest.');
}
assertSafeAbsolutePath(options.tlsCertificatePath, 'TLS certificate path');
assertSafeAbsolutePath(options.tlsKeyPath, 'TLS key path');
} else if (options.tlsCertificatePath !== undefined || options.tlsKeyPath !== undefined) {
@@ -189,7 +195,15 @@ export const renderNginxConfig = (options) => {
...(production ? [renderTls(options.tlsCertificatePath, options.tlsKeyPath)] : []),
` root ${documentRoot};`,
' index index.html;',
renderAddHeaders(site, jsonLdCspHash),
...(production
? [
' gzip on;',
' gzip_vary on;',
' gzip_min_length 1;',
' gzip_types text/css application/javascript application/json image/svg+xml;',
]
: []),
renderAddHeaders(site, jsonLdCspHash, options.manifestDigest),
'',
' location = / {',
' try_files /index.html =404;',
@@ -229,7 +243,7 @@ const parseArguments = (arguments_) => {
}
const required = ['--config', '--json-ld-hash', '--artifact-manifest', '--document-root'];
for (const key of required) if (!values.has(key)) throw new Error(`Missing host config argument: ${key}`);
const allowed = new Set([...required, '--output', '--tls-certificate', '--tls-key']);
const allowed = new Set([...required, '--output', '--tls-certificate', '--tls-key', '--manifest-digest']);
for (const key of values.keys()) if (!allowed.has(key)) throw new Error(`Unknown host config argument: ${key}`);
return { values, alternateHosts };
};
@@ -247,6 +261,7 @@ export const generateHostConfig = async (arguments_) => {
alternateHosts,
tlsCertificatePath: values.get('--tls-certificate'),
tlsKeyPath: values.get('--tls-key'),
manifestDigest: values.get('--manifest-digest'),
});
const output = values.get('--output');
if (output === undefined) process.stdout.write(config);