cesnimda
9088dcffb9
- site image: multi-stage node build -> unprivileged nginx (non-root, read-only) - nginx: CSP + security headers, immutable asset caching, revalidated HTML, canonical trailing slash, preserved /Linkedin 301, legacy-WP 410s, custom 404 - externalise theme-init so CSP uses script-src 'self' (no inline hash) - prod + dev compose; .env.example; relay Dockerfile fixed (image ships app user) - Gitea Actions: quality, e2e, lighthouse budgets, relay build, image push on main - verified: both images build; relay healthz 200; site serves EN/NO with CSP + redirect Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
19 lines
701 B
Bash
19 lines
701 B
Bash
# Copy to .env and fill in. Secrets never go in git or in the image (DOCKER_SPEC §3).
|
|
|
|
# --- Contact relay: SMTP (submission endpoint of your mail provider) ---
|
|
SMTP_HOST=
|
|
SMTP_PORT=587
|
|
SMTP_USER=
|
|
SMTP_PASSWORD= # secret — provide via env file (chmod 600) or a Docker secret
|
|
RELAY_FROM= # optional From address; defaults to SMTP_USER / RELAY_TO
|
|
RELAY_TO=connor.babbington@cesnimda.co.uk
|
|
RELAY_ALLOWED_ORIGIN=https://cesnimda.co.uk
|
|
RELAY_RATE_LIMIT=5 # requests per window per IP
|
|
RELAY_WINDOW_SECONDS=600
|
|
|
|
# --- Site build ---
|
|
PUBLIC_SITE_URL=https://cesnimda.co.uk
|
|
|
|
# --- Infra ---
|
|
PROXY_NETWORK=web # name of the existing external reverse-proxy docker network
|