feat(nginx): add security headers with per-domain CSP #1

Merged

ashie merged 1 commit from franz-kafka/nixos-vps:feat/security-headers into main

2026-03-19 14:04:45 +00:00

franz-kafka commented

2026-03-19 14:03:36 +00:00

Owner

Summary

Adds security headers to all Nginx virtual hosts to address missing CSP, HSTS, and X-Content-Type-Options headers.

Headers added (all domains)

Strict-Transport-Security: 6 months, includeSubDomains, preload-ready
X-Content-Type-Options: nosniff
Permissions-Policy: camera=(), microphone=(), geolocation=()
Cross-Origin-Resource-Policy: same-origin
Cross-Origin-Opener-Policy: same-origin

Per-domain Content-Security-Policy

Service	CSP	Reason
Default	Strict (self-only)	Safe baseline
SearXNG	`null` (omitted)	Already sets its own CSP in settings.yml
Forgejo	Relaxed (unsafe-inline/eval)	Code highlighting (highlight.js)
Vaultwarden	Relaxed (unsafe-eval)	WebCrypto vault requires eval
AdGuard	N/A	Nginx vhost defined directly in module (404 page only)

Changes

modules/nginx.nix: New contentSecurityPolicy option per domain, security headers in vhost config
modules/forgejo.nix: Relaxed CSP for code highlighting
modules/vaultwarden.nix: Relaxed CSP for WebCrypto
configuration.nix: SearXNG CSP set to null

Testing

After merging, verify with securityheaders.com:

curl -sI https://search.ashisgreat.xyz | grep -i "strict-transport\|content-security\|x-content-type"
curl -sI https://git.ashisgreat.xyz | grep -i "strict-transport\|content-security\|x-content-type"
curl -sI https://vault.ashisgreat.xyz | grep -i "strict-transport\|content-security\|x-content-type"

## Summary Adds security headers to all Nginx virtual hosts to address missing CSP, HSTS, and X-Content-Type-Options headers. ### Headers added (all domains) - `Strict-Transport-Security`: 6 months, includeSubDomains, preload-ready - `X-Content-Type-Options`: nosniff - `Permissions-Policy`: camera=(), microphone=(), geolocation=() - `Cross-Origin-Resource-Policy`: same-origin - `Cross-Origin-Opener-Policy`: same-origin ### Per-domain Content-Security-Policy | Service | CSP | Reason | |---------|-----|--------| | **Default** | Strict (self-only) | Safe baseline | | **SearXNG** | `null` (omitted) | Already sets its own CSP in settings.yml | | **Forgejo** | Relaxed (unsafe-inline/eval) | Code highlighting (highlight.js) | | **Vaultwarden** | Relaxed (unsafe-eval) | WebCrypto vault requires eval | | **AdGuard** | N/A | Nginx vhost defined directly in module (404 page only) | ### Changes - `modules/nginx.nix`: New `contentSecurityPolicy` option per domain, security headers in vhost config - `modules/forgejo.nix`: Relaxed CSP for code highlighting - `modules/vaultwarden.nix`: Relaxed CSP for WebCrypto - `configuration.nix`: SearXNG CSP set to null ### Testing After merging, verify with [securityheaders.com](https://securityheaders.com): ```bash curl -sI https://search.ashisgreat.xyz | grep -i "strict-transport\|content-security\|x-content-type" curl -sI https://git.ashisgreat.xyz | grep -i "strict-transport\|content-security\|x-content-type" curl -sI https://vault.ashisgreat.xyz | grep -i "strict-transport\|content-security\|x-content-type" ```

franz-kafka added 1 commit 2026-03-19 14:03:37 +00:00

feat(nginx): add security headers with per-domain CSP fbea02867e

- Add HSTS (6 months, includeSubDomains, preload-ready)
- Add X-Content-Type-Options: nosniff
- Add Permissions-Policy (disable camera/mic/geolocation)
- Add Cross-Origin-Resource-Policy: same-origin
- Add Cross-Origin-Opener-Policy: same-origin
- Add configurable Content-Security-Policy per domain

Per-service CSP tuning:
- SearXNG: null (handles its own CSP in settings.yml)
- Forgejo: relaxed (unsafe-inline/eval for code highlighting)
- Vaultwarden: relaxed (unsafe-eval for WebCrypto vault)

Fixes: missing CSP, HSTS, X-Content-Type-Options headers