Loyyd
1d55bdb691
All checks were successful
Publish static bundles / publish (push) Successful in 3m19s
37 lines
1.8 KiB
Markdown
37 lines
1.8 KiB
Markdown
# Site security policy
|
|
|
|
The generated HTML includes a baseline Content Security Policy and referrer
|
|
policy so browsers receive protection even before an edge rule is installed.
|
|
The production edge must also set the following HTTP response headers for
|
|
`familyfed.ie`:
|
|
|
|
```text
|
|
Content-Security-Policy: default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; img-src 'self' data: https:; font-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://static.cloudflareinsights.com; connect-src 'self' https:; frame-src https://www.youtube.com https://www.youtube-nocookie.com https://player.vimeo.com; form-action 'self' mailto: https:; upgrade-insecure-requests
|
|
Cross-Origin-Opener-Policy: same-origin
|
|
Cross-Origin-Resource-Policy: same-site
|
|
Permissions-Policy: camera=(), geolocation=(), microphone=(), payment=(), usb=()
|
|
Referrer-Policy: strict-origin-when-cross-origin
|
|
Strict-Transport-Security: max-age=63072000; includeSubDomains
|
|
X-Content-Type-Options: nosniff
|
|
X-Frame-Options: DENY
|
|
```
|
|
|
|
The rule must be scoped to `http.host eq "familyfed.ie"`. If Plausible is
|
|
enabled on a non-default host, add that exact origin to `script-src`.
|
|
|
|
## Origin access
|
|
|
|
The public website virtual host must accept HTTP/HTTPS traffic only from
|
|
Cloudflare's published IPv4 and IPv6 ranges. Keep the S3 deployment API on
|
|
`s3-sites.bcgen.ie` reachable by Forgejo runners; do not apply the website
|
|
virtual-host restriction to the S3 API listener. Authenticated Origin Pulls or
|
|
a Cloudflare Tunnel are preferable when supported by the origin proxy.
|
|
|
|
Verify the restriction from a non-Cloudflare client with:
|
|
|
|
```bash
|
|
curl --resolve familyfed.ie:443:ORIGIN_IP https://familyfed.ie/
|
|
```
|
|
|
|
The request must fail before an HTTP response is served, while the normal
|
|
`https://familyfed.ie/` request must continue to succeed through Cloudflare.
|