opn

http/nginx.conf

@@ -23,6 +23,7 @@ http {
     uwsgi_temp_path /tmp/uwsgi_temp;
     scgi_temp_path /tmp/scgi_temp;
 
+    # Linux APT/RPM repository.
     server {
         listen 8080 default_server;
         server_name _;
@@ -34,8 +35,6 @@ http {
         add_header X-Content-Type-Options "nosniff" always;
         add_header X-Frame-Options "DENY" always;
         add_header Referrer-Policy "no-referrer" always;
-        add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
-        add_header Content-Security-Policy "default-src 'none'; style-src 'unsafe-inline'; img-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'" always;
 
         if ($request_method !~ ^(GET|HEAD)$) {
             return 405;
@@ -47,12 +46,54 @@ http {
         }
 
         location = / {
-            try_files /index.html @initializing;
+            try_files /index.html @linux_initializing;
         }
 
-        location @initializing {
+        location @linux_initializing {
             default_type text/html;
-            return 200 '<!doctype html><html lang="pl"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Rust Package Repository</title><style>body{font:16px system-ui,sans-serif;max-width:760px;margin:64px auto;padding:0 20px;color:#1f2937}code{background:#f3f4f6;padding:.15rem .35rem;border-radius:.3rem}</style></head><body><h1>Rust Package Repository</h1><p>Repozytorium HTTP działa. Pierwszy build pakietu jeszcze trwa albo nie został zakończony.</p><p>Stan buildera sprawdzisz przez <code>docker compose logs -f rust-package-builder</code>.</p></body></html>';
+            return 200 '<!doctype html><html><head><meta charset="utf-8"><title>RustProxy repository</title></head><body><h1>RustProxy Linux repository</h1><p>Repository is being initialized.</p></body></html>';
+        }
+
+        location ~ (^|/)\. {
+            deny all;
+        }
+
+        location / {
+            try_files $uri =404;
+        }
+    }
+
+    # OPNsense/FreeBSD pkg repository. It has a separate public URL and local port,
+    # but follows the same atomic repository/current switch as the Linux repo.
+    server {
+        listen 8081;
+        server_name _;
+
+        root /srv/repository/opnsense;
+        index index.html;
+        autoindex off;
+
+        #add_header X-Content-Type-Options "nosniff" always;
+        #add_header X-Frame-Options "DENY" always;
+        #add_header Referrer-Policy "no-referrer" always;
+        #add_header Cache-Control "no-cache, no-store, must-revalidate" always;
+
+        if ($request_method !~ ^(GET|HEAD)$) {
+            return 405;
+        }
+
+        location = /healthz {
+            default_type text/plain;
+            return 200 "ok\n";
+        }
+
+        location = / {
+            try_files /index.html @opnsense_initializing;
+        }
+
+        location @opnsense_initializing {
+            default_type text/html;
+            return 200 '<!doctype html><html><head><meta charset="utf-8"><title>RustProxy OPNsense repository</title></head><body><h1>RustProxy OPNsense repository</h1><p>Repository is being initialized.</p></body></html>';
         }
 
         location ~ (^|/)\. {