🐛 Nginx container fixes: CSP, MIME types, homepage-link

- CSP: script-src en style-src 'self' 'unsafe-inline' toegevoegd zodat inline scripts en styles niet geblokkeerd worden
- CSS/JS location blok verwijderd (vermeed header-inheritance bug en onnodige 1y cache voor PoC)
- Font MIME type font/ttf toegevoegd voor .ttf bestanden
- Homepage-link van /poc-moza/ naar / gecorrigeerd
- ZAD component hernoemd van 'frontend' naar 'proef'

Author: robbertbos

.github/workflows/preview.yml

@@ -77,7 +77,7 @@ jobs:
           api-key: ${{ secrets.ZAD_API_KEY }}
           project-id: pm-5sj
           deployment-name: pr${{ github.event.pull_request.number }}
-          component: frontend
+          component: proef
           image: ${{ needs.build.outputs.image }}
           comment-on-pr: true
           qr-code: true

.github/workflows/production.yml

@@ -68,6 +68,6 @@ jobs:
           api-key: ${{ secrets.ZAD_API_KEY }}
           project-id: pm-5sj
           deployment-name: poc
-          component: frontend
+          component: proef
           image: ${{ needs.build.outputs.image }}
           wait-for-ready: true

_includes/header-overheid.njk

@@ -1,6 +1,6 @@
 <header>
 	<figure class="logo">
-		<a href="/poc-moza/">
+		<a href="/">
 			<img src="{{ '/assets/images/beeldmerk-rijksoverheid.svg' | url }}" alt="Naar de homepage van MijnOverheid Zakelijk">
 		</a>
 	</figure>

container/default.conf

@@ -12,18 +12,13 @@ server {
     add_header X-Frame-Options "SAMEORIGIN" always;
     add_header Referrer-Policy "strict-origin-when-cross-origin" always;
     add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
-    add_header Content-Security-Policy "default-src 'self'; img-src 'self' data:; object-src 'none'; base-uri 'self'; form-action 'none';" always;
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; base-uri 'self'; form-action 'none';" always;
     add_header Strict-Transport-Security "max-age=31536000" always;
 
     location /.well-known/security.txt {
         return 302 https://www.ncsc.nl/.well-known/security.txt;
     }
 
-    location ~* \.(css|js)$ {
-        expires 1y;
-        add_header Cache-Control "public, immutable";
-    }
-
     location / {
         try_files $uri $uri/ =404;
     }

container/nginx.conf

@@ -15,6 +15,9 @@ http {
     scgi_temp_path /tmp/scgi_temp;
 
     include /etc/nginx/mime.types;
+    types {
+        font/ttf ttf;
+    }
     default_type application/octet-stream;
 
     access_log off;