Harden client and WebSocket proxy

2026-09-09 13:04:56 +02:00
parent f4f95ffff4
commit 8986f6270f
64 changed files with 4410 additions and 7313 deletions
@@ -1,10 +1,17 @@
 mud.iamtalon.me {
+    header {
+        Content-Security-Policy "default-src 'self'; connect-src 'self' wss://mud.iamtalon.me; img-src 'self' data:; media-src 'self' https: blob:; style-src 'self' 'unsafe-inline'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'"
+        Referrer-Policy "no-referrer"
+        X-Content-Type-Options "nosniff"
+        X-Frame-Options "DENY"
+        Permissions-Policy "camera=(), microphone=(), geolocation=()"
+    }
    # For WebSocket requests to /mud-ws, proxy to the WebSocket server on port 3001
    @websocket {
        path /mud-ws*
    }
-    reverse_proxy @websocket svelte-mud:3001
+    reverse_proxy @websocket svelte-mud-proxy:3001

    # For all other requests, proxy to the SvelteKit app on port 3000
-    reverse_proxy svelte-mud:3000
+    reverse_proxy svelte-mud-app:3000
 }