Update http/nginx.conf

http/nginx.conf

@@ -23,8 +23,11 @@ http {
     uwsgi_temp_path /tmp/uwsgi_temp;
     scgi_temp_path /tmp/scgi_temp;
 
-    # Dynamic dashboard is private to the Docker network.
-    # Keep package catalogs/files served from local storage by nginx.
+    # Redirect all 404 responses, including upstream errors.
+    proxy_intercept_errors on;
+    error_page 404 = @redirect_home;
+
+    # Linux repository
     server {
         listen 8080 default_server;
         server_name _;
@@ -33,10 +36,6 @@ http {
         index index.html;
         autoindex off;
 
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header X-Frame-Options "DENY" always;
-        add_header Referrer-Policy "no-referrer" always;
-
         if ($request_method !~ ^(GET|HEAD)$) {
             return 405;
         }
@@ -46,18 +45,20 @@ http {
             return 200 "ok\n";
         }
 
-        # Actual site and its original /index.html link use the live dashboard.
         location = / {
             proxy_set_header X-Repo-Site linux;
             proxy_pass http://repository-dashboard:8000/;
         }
+
         location = /index.html {
             proxy_set_header X-Repo-Site linux;
             proxy_pass http://repository-dashboard:8000/index.html;
         }
+
         location ^~ /ui/ {
             proxy_pass http://repository-dashboard:8000;
         }
+
         location = /api/v1/packages {
             proxy_pass http://repository-dashboard:8000;
         }
@@ -70,9 +71,14 @@ http {
             expires 10m;
             try_files $uri =404;
         }
+
+        # Redirect 404 to homepage
+        location @redirect_home {
+            return 302 /;
+        }
     }
 
-    # Separate OPNsense hostname/port, with native FreeBSD at /freebsd/.
+    # OPNsense / FreeBSD repository
     server {
         listen 8081;
         server_name _;
@@ -81,10 +87,6 @@ http {
         index index.html;
         autoindex off;
 
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header X-Frame-Options "DENY" always;
-        add_header Referrer-Policy "no-referrer" always;
-
         if ($request_method !~ ^(GET|HEAD)$) {
             return 405;
         }
@@ -98,27 +100,35 @@ http {
             proxy_set_header X-Repo-Site opnsense;
             proxy_pass http://repository-dashboard:8000/;
         }
+
         location = /index.html {
             proxy_set_header X-Repo-Site opnsense;
             proxy_pass http://repository-dashboard:8000/index.html;
         }
-        location = /freebsd { return 301 /freebsd/; }
+
+        location = /freebsd {
+            return 301 /freebsd/;
+        }
+
         location = /freebsd/ {
             proxy_set_header X-Repo-Site freebsd;
             proxy_pass http://repository-dashboard:8000/freebsd/;
         }
+
         location = /freebsd/index.html {
             proxy_set_header X-Repo-Site freebsd;
             proxy_pass http://repository-dashboard:8000/freebsd/index.html;
         }
+
         location ^~ /ui/ {
             proxy_pass http://repository-dashboard:8000;
         }
+
         location = /api/v1/packages {
             proxy_pass http://repository-dashboard:8000;
         }
 
-        # Nginx still handles pkg catalog downloads directly, untouched.
+        # Serve FreeBSD package catalogs directly
         location /freebsd/ {
             alias /srv/repository/freebsd/;
             expires 10m;
@@ -133,5 +143,10 @@ http {
             expires 10m;
             try_files $uri =404;
         }
+
+        # Redirect 404 to homepage
+        location @redirect_home {
+            return 302 /;
+        }
     }
 }