small www

http/nginx.conf

@@ -0,0 +1,67 @@
+worker_processes 1;
+pid /tmp/nginx.pid;
+error_log /dev/stderr warn;
+
+events {
+    worker_connections 256;
+}
+
+http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+
+    access_log /dev/stdout;
+    server_tokens off;
+    sendfile on;
+    tcp_nopush on;
+    keepalive_timeout 15s;
+    client_max_body_size 1k;
+
+    client_body_temp_path /tmp/client_temp;
+    proxy_temp_path /tmp/proxy_temp;
+    fastcgi_temp_path /tmp/fastcgi_temp;
+    uwsgi_temp_path /tmp/uwsgi_temp;
+    scgi_temp_path /tmp/scgi_temp;
+
+    server {
+        listen 8080 default_server;
+        listen [::]:8080 default_server;
+        server_name _;
+
+        root /srv/repository;
+        index index.html;
+        autoindex off;
+
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header X-Frame-Options "DENY" always;
+        add_header Referrer-Policy "no-referrer" always;
+        add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+        add_header Content-Security-Policy "default-src 'none'; style-src 'unsafe-inline'; img-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'" always;
+
+        if ($request_method !~ ^(GET|HEAD)$) {
+            return 405;
+        }
+
+        location = /healthz {
+            default_type text/plain;
+            return 200 "ok\n";
+        }
+
+        location = / {
+            try_files /index.html @initializing;
+        }
+
+        location @initializing {
+            default_type text/html;
+            return 200 '<!doctype html><html lang="pl"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Rust Package Repository</title><style>body{font:16px system-ui,sans-serif;max-width:760px;margin:64px auto;padding:0 20px;color:#1f2937}code{background:#f3f4f6;padding:.15rem .35rem;border-radius:.3rem}</style></head><body><h1>Rust Package Repository</h1><p>Repozytorium HTTP działa. Pierwszy build pakietu jeszcze trwa albo nie został zakończony.</p><p>Stan buildera sprawdzisz przez <code>docker compose logs -f rust-package-builder</code>.</p></body></html>';
+        }
+
+        location ~ (^|/)\. {
+            deny all;
+        }
+
+        location / {
+            try_files $uri =404;
+        }
+    }
+}