Darkraise
ee9c2a296f
- Pin DNS resolution to prevent SSRF rebinding between check and connect (GameDataDownloader) - Fail-closed on realpath failure in GameZipServer - Zip Slip validation before extraction (RuffleService) - Escape LIKE wildcards in ActivityService queries - Sanitize sort order to prevent SQL injection - Whitelist sort order instead of passing raw user input - Add headersSent guard to global error handler - Remove cookie from CGI allowed headers, sanitize content-type against null/CR/LF injection - Revoke refresh tokens on password change and user deactivation - Wrap role/user uniqueness checks in transactions (TOCTOU fix) - Fix concurrent ZIP mount race with deferred promise and double-close prevention via _manuallyClosed flag - Handle client disconnect in collectRequestBody - Tighten nginx CSP, repeat headers in location blocks, hide server version, pin nginx:1.27-alpine - Fix health check endpoint path in backend Dockerfile - Use wget instead of curl for frontend health checks - Replace any types with proper types across backend and frontend - Replace || with ?? for config/form defaults - Replace hardcoded Tailwind colors with theme tokens - Replace console.log/error with logger in ErrorReporter and ChartErrorBoundary - Conditionally render AddToPlaylistModal to avoid hidden instances - Add NaN guards for parseInt in GameBrowseLayout - Standardize query key for publicSettings - Simplify README to Docker-first quickstart with wiki link - Fix license to GPL-3.0 in backend package.json - Slow down particle animation speed - Add Zod max-length limits on playlist/error schemas - Ensure positive limit in parsePaginationQuery - Validate settings category param against allowlist - Fix static/parameterized route ordering in favorites - Add asyncHandler to game-zip wildcard route - Close readline/stream on error in getRecentErrors - Add .catch() on fire-and-forget syncAndReload - Fix LazyBackgroundImage cleanup on unmount - Store NetworkStatusIndicator timeout in ref - Add Flash/SWF condition to random game query
52 lines
1.4 KiB
Nginx Configuration File
52 lines
1.4 KiB
Nginx Configuration File
# Main nginx configuration for Flashpoint Web Frontend
|
|
# Optimized for Docker container running as non-root user
|
|
|
|
# Don't use 'user' directive when running as non-root
|
|
# worker_processes auto is fine for most cases
|
|
worker_processes auto;
|
|
|
|
# Log to stdout/stderr for Docker (no file permission issues)
|
|
error_log /dev/stderr warn;
|
|
|
|
# PID file location (must be writable by non-root user)
|
|
pid /tmp/nginx.pid;
|
|
|
|
events {
|
|
worker_connections 1024;
|
|
use epoll;
|
|
multi_accept on;
|
|
}
|
|
|
|
http {
|
|
# Hide nginx version in headers and error pages
|
|
server_tokens off;
|
|
|
|
# Include mime types
|
|
include /etc/nginx/mime.types;
|
|
default_type application/octet-stream;
|
|
|
|
# Logging to stdout for Docker
|
|
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
|
'$status $body_bytes_sent "$http_referer" '
|
|
'"$http_user_agent" "$http_x_forwarded_for"';
|
|
|
|
access_log /dev/stdout main;
|
|
|
|
# Performance optimizations
|
|
sendfile on;
|
|
tcp_nopush on;
|
|
tcp_nodelay on;
|
|
keepalive_timeout 65;
|
|
types_hash_max_size 2048;
|
|
|
|
# Temp directories (must be writable by non-root user)
|
|
client_body_temp_path /tmp/client_temp;
|
|
proxy_temp_path /tmp/proxy_temp;
|
|
fastcgi_temp_path /tmp/fastcgi_temp;
|
|
uwsgi_temp_path /tmp/uwsgi_temp;
|
|
scgi_temp_path /tmp/scgi_temp;
|
|
|
|
# Include server configurations
|
|
include /etc/nginx/conf.d/*.conf;
|
|
}
|