Update default.conf.sample to deny dotfile access#54
Conversation
Signed-off-by: Eric Nemchik <eric@nemchik.com>
|
This pull request has been automatically marked as stale because it has not had recent activity. This might be due to missing feedback from OP. It will be closed if no further activity occurs. Thank you for your contributions. |
|
I am a bot, here are the test results for this PR:
|
|
I am a bot, here are the test results for this PR:
|
Signed-off-by: Eric Nemchik <eric@nemchik.com>
There was a problem hiding this comment.
Pull request overview
This PR updates the bundled nginx site config sample to broadly deny access to dotfiles (while carving out an exception for /.well-known) and refreshes the project changelog to notify existing users.
Changes:
- Add an nginx
locationrule to deny access to dotfiles, with an explicit allow rule for/.well-known. - Reformat several existing nginx
locationblocks for readability/consistency. - Add a readme changelog entry indicating existing users should update their nginx site config.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| root/defaults/nginx/site-confs/default.conf.sample | Adds dotfile denial rule and a /.well-known exception; reformats several security/caching blocks. |
| readme-vars.yml | Adds a changelog entry instructing users to update their nginx config due to dotfile denial. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| index index.html index.htm index.php; | ||
|
|
||
| # Allow access to the ".well-known" directory | ||
| location ^~ /.well-known { |
| # deny all direct access for these folders | ||
| location ~* /(\.git|cache|bin|logs|backup|tests)/.*$ { return 403; } | ||
| location ~* /(\.git|cache|bin|logs|backup|tests)/.*$ { | ||
| return 403; | ||
| } |
| "grav:latest" <- Base Images | ||
| # changelog | ||
| changelogs: | ||
| - {date: "08.02.26:", desc: "Existing users should update: site-confs/default.conf - Deny access to all dotfiles."} |
|
I am a bot, here are the test results for this PR:
|
No description provided.