From 26c6f1c55fb5ab129f27752152dbfe0a5318fcd4 Mon Sep 17 00:00:00 2001 From: Eric Nemchik Date: Sun, 8 Feb 2026 09:39:28 -0600 Subject: [PATCH 1/2] Update default.conf.sample to deny dotfile access Signed-off-by: Eric Nemchik --- readme-vars.yml | 1 + .../nginx/site-confs/default.conf.sample | 18 ++++++++++++++---- 2 files changed, 15 insertions(+), 4 deletions(-) diff --git a/readme-vars.yml b/readme-vars.yml index 98f0e84..21e748d 100644 --- a/readme-vars.yml +++ b/readme-vars.yml @@ -86,6 +86,7 @@ init_diagram: | "budge:latest" <- Base Images # changelog changelogs: + - {date: "08.02.26:", desc: "Existing users should update: site-confs/default.conf - Deny access to all dotfiles."} - {date: "06.06.24:", desc: "Rebase to Alpine 3.20. Existing users should update their nginx confs to avoid http2 deprecation warnings."} - {date: "06.03.24:", desc: "Existing users should update: site-confs/default.conf - Cleanup default site conf."} - {date: "06.03.24:", desc: "Rebase to Alpine 3.19 with php 8.3."} diff --git a/root/defaults/nginx/site-confs/default.conf.sample b/root/defaults/nginx/site-confs/default.conf.sample index 098bab0..9add284 100644 --- a/root/defaults/nginx/site-confs/default.conf.sample +++ b/root/defaults/nginx/site-confs/default.conf.sample @@ -1,10 +1,12 @@ -## Version 2024/07/16 - Changelog: https://github.com/linuxserver/docker-budge/commits/main/root/defaults/nginx/site-confs/default.conf.sample +## Version 2026/02/08 - Changelog: https://github.com/linuxserver/docker-budge/commits/main/root/defaults/nginx/site-confs/default.conf.sample server { listen 80 default_server; listen [::]:80 default_server; listen 443 ssl default_server; listen [::]:443 ssl default_server; + listen 443 quic reuseport default_server; + listen [::]:443 quic reuseport default_server; server_name _; @@ -22,13 +24,21 @@ server { } location /api/ { - rewrite /foo/(.*) /$1 break; + rewrite /foo/(.*) /$1 break; proxy_set_header Upgrade $http_upgrade; proxy_pass http://localhost:5000/; } - # deny access to .htaccess/.htpasswd files - location ~ /\.ht { + # deny access to all dotfiles + location ~ /\. { deny all; + log_not_found off; + access_log off; + return 404; + } + + # Allow access to the ".well-known" directory + location ^~ /.well-known { + allow all; } } From 1897f2eae6406104d53814916576169e125bd2cc Mon Sep 17 00:00:00 2001 From: Eric Nemchik Date: Tue, 5 May 2026 16:41:56 -0500 Subject: [PATCH 2/2] Move dotfile denial up Signed-off-by: Eric Nemchik --- .../nginx/site-confs/default.conf.sample | 29 +++++++++---------- 1 file changed, 13 insertions(+), 16 deletions(-) diff --git a/root/defaults/nginx/site-confs/default.conf.sample b/root/defaults/nginx/site-confs/default.conf.sample index 9add284..c31f2df 100644 --- a/root/defaults/nginx/site-confs/default.conf.sample +++ b/root/defaults/nginx/site-confs/default.conf.sample @@ -1,12 +1,10 @@ -## Version 2026/02/08 - Changelog: https://github.com/linuxserver/docker-budge/commits/main/root/defaults/nginx/site-confs/default.conf.sample +## Version 2026/05/05 - Changelog: https://github.com/linuxserver/docker-budge/commits/main/root/defaults/nginx/site-confs/default.conf.sample server { listen 80 default_server; listen [::]:80 default_server; listen 443 ssl default_server; listen [::]:443 ssl default_server; - listen 443 quic reuseport default_server; - listen [::]:443 quic reuseport default_server; server_name _; @@ -15,6 +13,18 @@ server { root /app/www/public/frontend/build; index index.html; + # Allow access to the ".well-known" directory + location ^~ /.well-known { + allow all; + } + + # deny access to all dotfiles + location ~ /\. { + access_log off; + log_not_found off; + return 404; + } + location / { # enable for basic auth #auth_basic "Restricted"; @@ -28,17 +38,4 @@ server { proxy_set_header Upgrade $http_upgrade; proxy_pass http://localhost:5000/; } - - # deny access to all dotfiles - location ~ /\. { - deny all; - log_not_found off; - access_log off; - return 404; - } - - # Allow access to the ".well-known" directory - location ^~ /.well-known { - allow all; - } }