ssmithx
0bf9b8997c
Dedicated nginx server block on :8543 (not proxied under the dashboard's 80/443) because the dashboard sets Permissions-Policy: geolocation=() server-wide, which would silently break Regress's core claim/link mechanic. Also documents a found-but-not-fixed gap: the dashboard's app iframe has no allow="geolocation", so the in-dashboard launch path won't get location access either until that shared component is patched.
28 lines
1.1 KiB
Plaintext
28 lines
1.1 KiB
Plaintext
server {
|
|
listen 8543 ssl;
|
|
listen [::]:8543 ssl;
|
|
server_name _;
|
|
|
|
ssl_certificate /etc/archipelago/ssl/archipelago.crt;
|
|
ssl_certificate_key /etc/archipelago/ssl/archipelago.key;
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
|
|
|
|
# Regress needs browser geolocation for its core claim/link mechanic — the
|
|
# main archipelago dashboard's server blocks (80/443) set
|
|
# Permissions-Policy: geolocation=() globally, which would silently break
|
|
# this feature if Regress were proxied under those. This is a dedicated
|
|
# server block on its own port specifically so it isn't subject to that.
|
|
add_header Permissions-Policy "geolocation=(self)" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
|
|
location / {
|
|
proxy_pass http://127.0.0.1:8199;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $http_host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
}
|
|
}
|