Cleanup nginx conf

docker/batch-test.env

@@ -72,7 +72,6 @@ INTERNETNL_CACHE_RESET_ALLOWLIST=target.test
 
 # allow localhost for healthchecks, the public domain for the app and it's subdomains for connection tests
 ALLOWED_HOSTS=127.0.0.1,::1,localhost,.internet.test,internet.test
-CSP_DEFAULT_SRC="'self',*.internet.test"
 
 IPV6_TEST_ADDR=fd00:43:1::100
 CONN_TEST_DOMAIN=internet.test

docker/compose.yaml

@@ -143,7 +143,6 @@ services:
       - CONN_TEST_DOMAIN
       - SMTP_EHLO_DOMAIN
       - IPV6_TEST_ADDR
-      - CSP_DEFAULT_SRC
       - IPV4_IP_RESOLVER_INTERNAL_VALIDATING
       - IPV4_IP_RESOLVER_INTERNAL_PERMISSIVE
       - SENTRY_DSN

docker/defaults.env

@@ -158,7 +158,6 @@ POSTGRES_DB=internetnl_db1
 
 # allow localhost for healthchecks, the public domain for the app and it's subdomains for connection tests
 ALLOWED_HOSTS=127.0.0.1,::1,localhost,.internet.nl,internet.nl,host.docker.internal
-CSP_DEFAULT_SRC="'self',*.internet.nl"
 
 # to low of an interval burdens the services, to high causes slow compose up/restarts
 HEALTHCHECK_INTERVAL=60s

docker/develop.env

@@ -30,7 +30,6 @@ INTERNETNL_CACHE_TTL=30
 
 # allow localhost for healthchecks, the public domain for the app and it's subdomains for connection tests
 ALLOWED_HOSTS=127.0.0.1,::1,localhost,.internet.test,internet.test,host.docker.internal,host-gateway
-CSP_DEFAULT_SRC="'self',*.internet.test"
 
 # domainname used for connection test
 CONN_TEST_DOMAIN=internet.test

docker/host-dist.env

@@ -12,7 +12,6 @@ IPV6_IP_PUBLIC=$IPV6_IP_PUBLIC
 IPV4_IP_PUBLIC=$IPV4_IP_PUBLIC
 
 ALLOWED_HOSTS=127.0.0.1,::1,localhost,.$INTERNETNL_DOMAINNAME,$INTERNETNL_DOMAINNAME
-CSP_DEFAULT_SRC="'self',https://*.$INTERNETNL_DOMAINNAME"
 
 MATOMO_SUBDOMAIN_TRACKING=*.$INTERNETNL_DOMAINNAME
 

docker/test.env

@@ -69,7 +69,6 @@ INTERNETNL_CACHE_RESET_ALLOWLIST=target.test
 
 # allow localhost for healthchecks, the public domain for the app and it's subdomains for connection tests
 ALLOWED_HOSTS=127.0.0.1,::1,localhost,.internet.test,internet.test
-CSP_DEFAULT_SRC="'self',*.internet.test"
 
 IPV6_TEST_ADDR=fd00:43:1::100
 CONN_TEST_DOMAIN=internet.test

docker/webserver.Dockerfile

@@ -36,3 +36,6 @@ COPY interface/static/favicon.ico /var/www/internet.nl/
 
 COPY docker/webserver/nginx_templates/* /etc/nginx/templates/
 COPY docker/webserver/mime.types /etc/nginx/
+COPY docker/webserver/http.headers /etc/nginx/
+COPY docker/webserver/hsts.header /etc/nginx/
+COPY docker/webserver/all.headers /etc/nginx/

docker/webserver/10-variables.envsh

@@ -2,4 +2,5 @@
 # split comma separated list into space separated
 export REDIRECT_DOMAINS_LIST=$(echo $REDIRECT_DOMAINS | sed 's/,/ /')
 
-export LANGUAGES_REGEX=$(echo $LANGUAGES | tr ',' '|')
+export LANGUAGES_REGEX=$(echo $LANGUAGES | sed -r ';s/,/\\.|/g;s/$/\\./')
+export INTERNETNL_DOMAINNAME_REGEX=$(echo $INTERNETNL_DOMAINNAME | sed 's/\./\\./g')

docker/webserver/all.headers

@@ -0,0 +1,3 @@
+include http.headers;
+include hsts.header;
+include conf.d/csp.header;

docker/webserver/hsts.header

@@ -0,0 +1,4 @@
+ # Do *not* add includeSubdomains before https://github.com/internetstandards/Internet.nl/issues/324 is resolved,
+ # adding includeSubdomains without adding the wildcard SSL certificates will otherwise break the connection test.
+ add_header 'Strict-Transport-Security' 'max-age=31536000;' always;
+

docker/webserver/http.headers

@@ -0,0 +1,7 @@
+ # default headers added to all responses
+ add_header 'X-Frame-Options' 'SAMEORIGIN' always;
+ add_header 'X-Content-Type-Options' 'nosniff' always;
+ add_header 'X-Clacks-Overhead' 'GNU Terry Pratchett' always;
+ add_header 'Referrer-Policy' 'same-origin' always;
+ add_header 'X-XSS-Protection' '1; mode=block' always;
+