Skip to content

Commit a7c1204

Browse files
djbedjbe
committed
Nginx: rework CSP config to use ENV vars
1 parent 87bee06 commit a7c1204

File tree

8 files changed

+104
-49
lines changed

8 files changed

+104
-49
lines changed

‎.github/workflows/build-and-publish-nuxt-base.yml‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -22,13 +22,8 @@ jobs:
2222
info:
2323
- version: lts
2424
node: lts
25-
target: secure
26-
- version: lts-unsecured
27-
node: lts
28-
target: unsecured
2925
with:
3026
image: nuxt-base
3127
version: ${{ matrix.info.version }}
32-
target: ${{ matrix.info.target }}
3328
build-args: |
3429
NODE_VERSION=${{ matrix.info.node }}

‎.github/workflows/build-and-publish-web-base.yml‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,6 @@ jobs:
2121
matrix:
2222
info:
2323
- version: latest
24-
target: secure
25-
- version: latest-unsecured
26-
target: unsecured
2724
with:
2825
image: web-base
2926
version: ${{ matrix.info.version }}
30-
target: ${{ matrix.info.target }}

‎README.md‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,38 @@ Changes to this repository will trigger a build and push to GitHub packages auto
1212

1313
Images with `nginx` can be configured using the following environment variables.
1414

15+
### Content Security Policy
16+
17+
Fetch:
18+
19+
| Environment Key | Applied | Description | Default |
20+
------------------|---------|------------------------
21+
| NGINX_CSP_CHILD_SRC | Every run | Allowed children (workers, frames) | |
22+
| NGINX_CSP_CONNECT_SRC | Every run | Allowed connections (socket, xhr, …) | |
23+
| NGINX_CSP_FONT_SRC | Every run | Allowed fonts | |
24+
| NGINX_CSP_FRAME_SRC | Every run | Allowed iframes | |
25+
| NGINX_CSP_IMG_SRC | Every run | Allowed images | `https:` |
26+
| NGINX_CSP_MANIFEST_SRC | Every run | Allowed manifests | |
27+
| NGINX_CSP_MEDIA_SRC | Every run | Allowed media | `https:` |
28+
| NGINX_CSP_OBJECT_SRC | Every run | Allowed embeds | |
29+
| NGINX_CSP_SCRIPT_SRC | Every run | Allowed scripts | |
30+
| NGINX_CSP_STYLE_SRC | Every run | Allowed styles | |
31+
| NGINX_CSP_WORKER_SRC | Every run | Allowed workers | |
32+
33+
Navigation:
34+
35+
| Environment Key | Applied | Description | Default |
36+
------------------|---------|------------------------
37+
| NGINX_FRAME_OPTIONS | Every run | Possible embedders, deprecated. Note that setting to `disable` removes the header completely. | `deny` |
38+
| NGINX_CSP_FRAME_ANCESTORS | Every run | Possible embedders | `none` |
39+
| NGINX_CSP_FORM_ACTION | Every run | Form submit action | |
40+
41+
Reporting:
42+
43+
| Environment Key | Applied | Description | Default |
44+
------------------|---------|------------------------
45+
| NGINX_CSP_REPORT_URI | Every run | Set to Sentry CSP reporting URI | |
46+
1547
### Robots
1648

1749
| Environment Key | Applied | Description | Default |

‎common/config/nginx/site-mods-available.d/headers-extra-security.conf‎

Lines changed: 0 additions & 7 deletions
This file was deleted.

‎common/config/nginx/site-mods-enabled.d/headers-extra-security.conf‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎common/scripts/startup/env-configure-security.sh‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
#!/usr/bin/env sh
2+
3+
set -euo pipefail
4+
5+
# Configure nginx security based on ENV vars
6+
#
7+
# Inputs:
8+
# - NGINX_CSP_CHILD_SRC: defaults to ''
9+
# - NGINX_CSP_CONNECT_SRC: defaults to ''
10+
# - NGINX_CSP_FONT_SRC: defaults to ''
11+
# - NGINX_CSP_FORM_ACTION: defaults to ''
12+
# - NGINX_CSP_FRAME_ANCESTORS: defaults to 'none'
13+
# - NGINX_CSP_FRAME_SRC: defaults to ''
14+
# - NGINX_CSP_IMG_SRC: defaults to 'https:'
15+
# - NGINX_CSP_MANIFEST_SRC: defaults to ''
16+
# - NGINX_CSP_MEDIA_SRC: defaults to 'https:'
17+
# - NGINX_CSP_OBJECT_SRC: defaults to ''
18+
# - NGINX_CSP_REPORT_URI: defaults to ''
19+
# - NGINX_CSP_SCRIPT_SRC: defaults to ''
20+
# - NGINX_CSP_STYLE_SRC: defaults to ''
21+
# - NGINX_CSP_WORKER_SRC: defaults to ''
22+
# - NGINX_FRAME_OPTIONS: defaults to 'deny', note that setting to `disable` removes the header completely.
23+
24+
# Set defaults
25+
NGINX_CSP_CHILD_SRC="${NGINX_CSP_CHILD_SRC:-}"
26+
NGINX_CSP_CONNECT_SRC="${NGINX_CSP_CONNECT_SRC:-}"
27+
NGINX_CSP_FONT_SRC="${NGINX_CSP_FONT_SRC:-}"
28+
NGINX_CSP_FORM_ACTION="${NGINX_CSP_FORM_ACTION:-}"
29+
NGINX_CSP_FRAME_ANCESTORS="${NGINX_CSP_FRAME_ANCESTORS:-'none'}"
30+
NGINX_CSP_FRAME_SRC="${NGINX_CSP_FRAME_SRC:-}"
31+
NGINX_CSP_IMG_SRC="${NGINX_CSP_IMG_SRC:-https:}"
32+
NGINX_CSP_MANIFEST_SRC="${NGINX_CSP_MANIFEST_SRC:-}"
33+
NGINX_CSP_MEDIA_SRC="${NGINX_CSP_MEDIA_SRC:-https:}"
34+
NGINX_CSP_OBJECT_SRC="${NGINX_CSP_OBJECT_SRC:-}"
35+
NGINX_CSP_REPORT_URI="${NGINX_CSP_REPORT_URI:-}"
36+
NGINX_CSP_SCRIPT_SRC="${NGINX_CSP_SCRIPT_SRC:-}"
37+
NGINX_CSP_STYLE_SRC="${NGINX_CSP_STYLE_SRC:-}"
38+
NGINX_CSP_WORKER_SRC="${NGINX_CSP_WORKER_SRC:-}"
39+
NGINX_FRAME_OPTIONS="${NGINX_FRAME_OPTIONS:-deny}"
40+
41+
if [ -d /etc/nginx/site-mods-enabled.d/ ]; then
42+
# nginx frame options header
43+
if [ "${NGINX_FRAME_OPTIONS}" != 'disable' ]; then
44+
echo "Nginx: configuring frame options with '${NGINX_FRAME_OPTIONS}'…"
45+
cat <<EOF > /etc/nginx/site-mods-enabled.d/00-generated-security.conf
46+
add_header 'X-Frame-Options' '${NGINX_FRAME_OPTIONS}' always;
47+
EOF
48+
fi
49+
50+
# nginx content policy
51+
echo "Nginx: configuring content security policy…"
52+
cat <<EOF >> /etc/nginx/site-mods-enabled.d/00-generated-security.conf
53+
add_header 'Content-Security-Policy' "\
54+
default-src 'self'; \
55+
child-src 'self' data: blob: ${NGINX_CSP_CHILD_SRC}; \
56+
connect-src 'self' data: blob: ${NGINX_CSP_CONNECT_SRC}; \
57+
font-src 'self' ${NGINX_CSP_FONT_SRC}; \
58+
form-action 'self' ${NGINX_CSP_FORM_ACTION}; \
59+
frame-ancestors ${NGINX_CSP_FRAME_ANCESTORS}; \
60+
frame-src 'self' ${NGINX_CSP_FRAME_SRC}; \
61+
img-src 'self' data: blob: ${NGINX_CSP_IMG_SRC}; \
62+
manifest-src 'self' data: blob: ${NGINX_CSP_MANIFEST_SRC}; \
63+
media-src 'self' ${NGINX_CSP_MEDIA_SRC}; \
64+
object-src 'self' ${NGINX_CSP_OBJECT_SRC}; \
65+
script-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ${NGINX_CSP_SCRIPT_SRC}; \
66+
style-src 'self' 'unsafe-inline' ${NGINX_CSP_STYLE_SRC}; \
67+
worker-src 'self' data: blob: ${NGINX_CSP_WORKER_SRC}; \
68+
report-uri ${NGINX_CSP_REPORT_URI}; \
69+
";
70+
EOF
71+
fi

‎nuxt-base/Dockerfile‎

Lines changed: 1 addition & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -26,26 +26,9 @@ COPY common/scripts/ nuxt-base/scripts/ /scripts/
2626
WORKDIR /app/www
2727
RUN chown -R nobody:nobody /scripts /app/www /run /var/lib/nginx /var/log/nginx /etc/nginx/site-mods-enabled.d \
2828
&& addgroup nobody tty
29+
USER nobody
2930
EXPOSE 8080
3031

3132
# Start supervisord by default
3233
ENTRYPOINT ["/scripts/docker-entrypoint.sh"]
3334
CMD ["serve"]
34-
35-
#
36-
# --- Variant: Unsecured ---
37-
#
38-
39-
FROM base AS unsecured
40-
41-
RUN rm /etc/nginx/site-mods-enabled.d/headers-extra-security.conf
42-
43-
USER nobody
44-
45-
#
46-
# --- Variant: Secure (default) ---
47-
#
48-
49-
FROM base AS secure
50-
51-
USER nobody

‎web-base/Dockerfile‎

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -41,17 +41,3 @@ EXPOSE 80
4141
# Start supervisord by default
4242
ENTRYPOINT ["/scripts/docker-entrypoint.sh"]
4343
CMD ["serve"]
44-
45-
#
46-
# --- Variant: Unsecured ---
47-
#
48-
49-
FROM base AS unsecured
50-
51-
RUN rm /etc/nginx/site-mods-enabled.d/headers-extra-security.conf
52-
53-
#
54-
# --- Variant: Secure (default) ---
55-
#
56-
57-
FROM base AS secure

0 commit comments

Comments
 (0)