7 commits

Author	SHA1	Message	Date
wurongjie	b807fb3ee1	fix(security): harden CSP policy and hide nginx server tokens ... - Remove 'unsafe-inline' and 'unsafe-eval' from script-src directive - Restrict connect-src to 'self' only - Disable nginx server_tokens to hide version information Signed-off-by: wurongjie <wurongjie@uniontech.com>	2026-08-24 17:02:42 +08:00
philsun	34f244e7a4	feat(web): support configurable base-path deployment ... Signed-off-by: philsun <xinyi.sun@daocloud.io>	2026-08-05 12:50:26 +08:00
XiaoSeS	e4fb26d4ba	fix(nginx): trust forwarded proto only when configured ... Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-07-28 20:03:50 +08:00
wurongjie	42da467336	fix(nginx): use X-Forwarded-Proto header for proper protocol forwarding ... Replace $scheme with $http_x_forwarded_proto in proxy headers to correctly forward the original client protocol when behind a reverse proxy or load balancer. This fixes OAuth2 authentication issues where redirects would use the wrong protocol scheme.	2026-05-15 13:53:26 +08:00
XiaoSeS	3366d018dc	fix: increase nginx upload limit and filter Chrome DevTools logs (#195) ... * fix: increase nginx upload limit and filter Chrome DevTools logs - Add client_max_body_size 100M to nginx config to allow large skill package uploads - Silently handle Chrome DevTools .well-known requests to reduce log noise Fixes #193 * remove	2026-03-31 09:38:51 +08:00
vsxd	012ed35a10	Serve registry skill docs from nginx	2026-03-18 17:56:53 +08:00
vsxd	9ae9b93ca7	Refine production compose runtime config	2026-03-13 17:00:47 +08:00

Renamed from web/nginx.conf (Browse further)