small www

tests/static.sh

@@ -7,6 +7,7 @@ for f in "$ROOT"/start.sh "$ROOT"/scripts/*.sh "$ROOT"/tests/*.sh; do
 done
 
 grep -q 'FROM rockylinux:9' "$ROOT/Dockerfile"
+grep -q 'dnf -y install --allowerasing' "$ROOT/Dockerfile"
 grep -q 'python3.11' "$ROOT/Dockerfile"
 grep -q 'RUST_PROXY_PYTHON=/usr/bin/python3.11' "$ROOT/Dockerfile"
 grep -q 'nfpm package' "$ROOT/scripts/build-release.sh"
@@ -18,10 +19,22 @@ grep -q 'repo add -force-replace' "$ROOT/scripts/build-release.sh"
 grep -q '/run/package-builder/gnupg' "$ROOT/scripts/entrypoint.sh"
 grep -q 'rustproxy-overview.json' "$ROOT/scripts/prepare-package.sh"
 grep -q 'debian/${PACKAGE_NAME}.service' "$ROOT/scripts/prepare-package.sh"
-grep -q 'gpg/private-key.asc' "$ROOT/start.sh"
+grep -q 'private-key.asc' "$ROOT/start.sh"
 grep -q 'docker compose' "$ROOT/start.sh"
 grep -q 'Key-Type: RSA' "$ROOT/start.sh"
+grep -q 'DEFAULT_HTTP_PORT=18765' "$ROOT/start.sh"
+grep -q 'repository-http' "$ROOT/start.sh"
 grep -Fq '${SOURCE_REPO:?SOURCE_REPO is required}' "$ROOT/docker-compose.yml"
 grep -Fq '${REPOSITORY_URL:?REPOSITORY_URL is required}' "$ROOT/docker-compose.yml"
+grep -q 'nginxinc/nginx-unprivileged:stable-alpine-slim' "$ROOT/docker-compose.yml"
+grep -q 'read_only: true' "$ROOT/docker-compose.yml"
+grep -q 'no-new-privileges:true' "$ROOT/docker-compose.yml"
+grep -q 'cap_drop:' "$ROOT/docker-compose.yml"
+grep -Fq '0.0.0.0:${HTTP_PORT:-18765}:8080' "$ROOT/docker-compose.yml"
+grep -q 'server_tokens off' "$ROOT/http/nginx.conf"
+grep -q 'GET|HEAD' "$ROOT/http/nginx.conf"
+grep -q 'autoindex off' "$ROOT/http/nginx.conf"
+grep -q 'X-Content-Type-Options' "$ROOT/http/nginx.conf"
+grep -q 'healthz' "$ROOT/http/nginx.conf"
 
 echo 'static checks: OK'