960ed0914f
Isolated namespace (Traefik-only ingress, no egress), pinned unprivileged nginx, / -> 200 notice, every other path -> 404, letsencrypt-prod TLS, HTTP->HTTPS redirect. Nothing proxies to OpenBao. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 150322@bnt-lap001 Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4
34 lines
1 KiB
Text
34 lines
1 KiB
Text
# Static notice for bao.coulomb.social (RPF-WP-0047). Serves one page; proxies nothing.
|
|
server {
|
|
listen 8080;
|
|
server_name _;
|
|
server_tokens off;
|
|
root /usr/share/nginx/html;
|
|
|
|
add_header Content-Security-Policy "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header Referrer-Policy "no-referrer" always;
|
|
add_header Cache-Control "no-store" always;
|
|
add_header X-Robots-Tag "noindex, nofollow" always;
|
|
|
|
location = / {
|
|
try_files /index.html =404;
|
|
}
|
|
location = /robots.txt {
|
|
default_type text/plain;
|
|
return 200 "User-agent: *\nDisallow: /\n";
|
|
}
|
|
location = /healthz {
|
|
access_log off;
|
|
default_type text/plain;
|
|
return 200 "ok\n";
|
|
}
|
|
# Any other path (e.g. /v1/sys/health, /ui/) is 404 with the same notice, never 200.
|
|
location / {
|
|
error_page 404 /index.html;
|
|
return 404;
|
|
}
|
|
location = /index.html {
|
|
internal;
|
|
}
|
|
}
|