feat: improve anubis whitelisting

nijel · nijel · commit 49f81c2719fb · 2025-11-18T11:49:02.000+01:00
Exclude legacy widgets urls and optional IdP integration.
diff --git a/etc/nginx/default.tpl b/etc/nginx/default.tpl
@@ -75,7 +75,7 @@ server {
     proxy_connect_timeout 3600;
 
 {% if WEBLATE_ANUBIS_URL %}
-    location ~ ^{{ WEBLATE_URL_PREFIX }}(/widget/|/exports/rss/|/healthz/|/hooks/|/accounts/complete/|/accounts/auth/) {
+    location ~ ^{{ WEBLATE_URL_PREFIX }}(/widgets?/|/idp/|/exports/rss/|/healthz/|/hooks/|/accounts/complete/|/accounts/auth/) {
         proxy_pass http://127.0.0.1:8081;
     }
 {% endif %}

Original file line number	Diff line number	Diff line change
`@@ -75,7 +75,7 @@ server {`
`75`	`75`	`proxy_connect_timeout 3600;`
`76`	`76`
`77`	`77`	`{% if WEBLATE_ANUBIS_URL %}`
`78`		`- location ~ ^{{ WEBLATE_URL_PREFIX }}(/widget/\|/exports/rss/\|/healthz/\|/hooks/\|/accounts/complete/\|/accounts/auth/) {`
	`78`	`+ location ~ ^{{ WEBLATE_URL_PREFIX }}(/widgets?/\|/idp/\|/exports/rss/\|/healthz/\|/hooks/\|/accounts/complete/\|/accounts/auth/) {`
`79`	`79`	`proxy_pass http://127.0.0.1:8081;`
`80`	`80`	`}`
`81`	`81`	`{% endif %}`