coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RPF-WP-0047: static notice page manifests for bao.coulomb.social

Browse source 
Isolated namespace (Traefik-only ingress, no egress), pinned unprivileged
nginx, / -> 200 notice, every other path -> 404, letsencrypt-prod TLS,
HTTP->HTTPS redirect. Nothing proxies to OpenBao.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 150322@bnt-lap001
Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4
This commit is contained in:
codex 2026-09-24 00:52:07 +02:00
parent 7f25af3cb1
commit 960ed0914f
4 changed files with 225 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

34
argocd/platform-addons/bao-notice/default.conf Normal file
View file

@ -0,0 +1,34 @@
# Static notice for bao.coulomb.social (RPF-WP-0047). Serves one page; proxies nothing.
server {
listen 8080;
server_name _;
server_tokens off;
root /usr/share/nginx/html;
add_header Content-Security-Policy "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer" always;
add_header Cache-Control "no-store" always;
add_header X-Robots-Tag "noindex, nofollow" always;
location = / {
try_files /index.html =404;
}
location = /robots.txt {
default_type text/plain;
return 200 "User-agent: *\nDisallow: /\n";
}
location = /healthz {
access_log off;
default_type text/plain;
return 200 "ok\n";
}
# Any other path (e.g. /v1/sys/health, /ui/) is 404 with the same notice, never 200.
location / {
error_page 404 /index.html;
return 404;
}
location = /index.html {
internal;
}
}