vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(#1263): repeat security headers in locations with their own add_header

Browse source
This commit is contained in:
damocles 2026-06-04 14:34:15 +02:00
commit 911dc5227b
1 changed files with 9 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

18
nix/modules/hive-gateway.nix
View file

@ -418,11 +418,7 @@ in
'';
}
{
assertion =
!cfg.hsts.enable
|| cfg.selfSignedTls
|| cfg.tls.certDir != null
|| cfg.tls.acme.enable;
assertion = !cfg.hsts.enable || cfg.selfSignedTls || cfg.tls.certDir != null || cfg.tls.acme.enable;
message = ''
services.hyperhive.gateway.hsts.enable = true requires TLS to be
configured (selfSignedTls, tls.certDir, or tls.acme.enable). HSTS
@ -549,10 +545,12 @@ in
# Security headers added at the server scope on every vhost.
# nginx's add_header inheritance rule: a location that defines its
# own add_header does NOT inherit the server-level ones, so API
# locations with CORS headers (e.g. /.well-known/matrix/client,
# /_matrix/) are unaffected. HTML-serving and proxy locations that
# carry no add_header of their own pick these up automatically.
# own add_header does NOT inherit the server-level ones. Any
# location with its own add_header (e.g. CORS on /.well-known or
# /_matrix/) must repeat the security headers explicitly — see those
# locations below. HTML-serving and proxy locations that carry no
# add_header of their own pick these up from the server scope
# automatically.
hstsDirectives = lib.concatStringsSep "; " (
[ "max-age=${toString cfg.hsts.maxAge}" ]
++ lib.optional cfg.hsts.includeSubDomains "includeSubDomains"
@ -726,6 +724,7 @@ in
"= /.well-known/matrix/client" = {
extraConfig = ''
default_type application/json;
${securityHeaders}
add_header Access-Control-Allow-Origin *;
return 200 '{"m.homeserver":{"base_url":"${clientBaseUrl}"}}';
'';
@ -906,6 +905,7 @@ in
client_max_body_size 50M;
proxy_read_timeout 1h;
proxy_send_timeout 1h;
${securityHeaders}
add_header Access-Control-Allow-Origin *;
'';
};