3 Commits

Include renames

Author	SHA1	Message	Date
Bastien Chanot	613bfc0d49	chore(clean): dedup CV/index CSS, drop dead directives (tour F1-F8) ... CV: shared block for xp/project/edu headers + date chips + roles + tags, 2 identical inline style attrs -> .inline-link class, no-op body margin/ padding removed, stray blank collapsed. Proven behavior-preserving: PDF text-hash + per-page render-hash + full byte-identity vs committed PDF. index: .stack-note/.theme-list code grouped, 2 no-op .formation overrides removed. nginx.conf: dead 'deny all' after return 404 removed (nginx -t + dotfile-404 oracle PASS). .dockerignore: phantom nginx.conf.bak entry. Snippet comment: CV style attrs no longer exist. CSP hash unchanged.	2026-07-05 22:52:39 +02:00
Bastien Chanot	c0632aefa8	fix(security): pin script-src to the inline script's sha256 hash (SEC-7) ... unsafe-inline dropped for scripts (index has zero style/script attributes; the single inline script is hash-pinned). style-src keeps unsafe-inline (CV carries 2 style attributes + single-file convention). Verified in hardened container: served-script hash == policy hash, JS executes.	2026-07-05 19:59:45 +02:00
Bastien Chanot	ba13d697a5	fix(security): unprivileged nginx + security headers on every location ... - base image -> nginxinc/nginx-unprivileged:1.28-alpine, digest-pinned (BREAKING for the docker path: container port 80 -> 8080; compose mapping/healthcheck updated in the same change, cap_add dropped) - nginx add_header inheritance fix: shared snippets file re-included in every location that sets Cache-Control -- previously ALL security headers were dropped on real responses (verified live before/after) - server_tokens off; set_real_ip_from restricted to 127.0.0.1 - expires directives removed (duplicated Cache-Control); gzip_types text/html redundancy removed (nginx -t warn)	2026-07-05 14:10:55 +02:00