cesnimda/jobtrackingapp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(security): enforce audited account, network and resource boundaries

Browse Source 
Implement B01-B06 with regression coverage and retained validation evidence. Preserve the production ingress preflight; F04 runtime verification remains open.
This commit is contained in:
cesnimda
2026-09-09 18:21:47 +02:00
parent 7d641edc7b
commit 0954876295
116 changed files with 10101 additions and 122 deletions
Download Patch File Download Diff File Expand all files Collapse all files
job-tracker-ui/nginx.conf.template
+20 -11
View File
@@ -1,3 +1,5 @@
__APP_INGRESS_HTTP__
server {
listen 80 default_server;
server_name "";
@@ -17,6 +19,8 @@ server {
listen 80;
server_name __APP_EXTERNAL_HOST__;
__APP_INGRESS_CHECK__
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
@@ -33,31 +37,36 @@ server {
proxy_pass http://backend-web:8080/health;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header Host __APP_EXTERNAL_AUTHORITY__;
proxy_set_header X-Real-IP $remote_addr;
# Traefik replaces these headers. Pass its sanitized values rather than appending another
# hop or replacing external HTTPS with nginx's internal HTTP scheme.
proxy_set_header X-Forwarded-For $http_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
# realip resolves one sanitized address only from an explicitly trusted socket peer.
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-Proto __APP_EXTERNAL_SCHEME__;
proxy_set_header X-Forwarded-Host "";
proxy_set_header Forwarded "";
}
location = /ready {
proxy_pass http://backend-web:8080/ready;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header Host __APP_EXTERNAL_AUTHORITY__;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $http_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-Proto __APP_EXTERNAL_SCHEME__;
proxy_set_header X-Forwarded-Host "";
proxy_set_header Forwarded "";
}
location /api/ {
proxy_pass http://backend-web:8080;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header Host __APP_EXTERNAL_AUTHORITY__;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $http_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-Proto __APP_EXTERNAL_SCHEME__;
proxy_set_header X-Forwarded-Host "";
proxy_set_header Forwarded "";
}
}