2 Commits

Include renames

Author	SHA1	Message	Date
Bastien Chanot	c0632aefa8	fix(security): pin script-src to the inline script's sha256 hash (SEC-7) ... unsafe-inline dropped for scripts (index has zero style/script attributes; the single inline script is hash-pinned). style-src keeps unsafe-inline (CV carries 2 style attributes + single-file convention). Verified in hardened container: served-script hash == policy hash, JS executes.	2026-07-05 19:59:45 +02:00
Bastien Chanot	ba13d697a5	fix(security): unprivileged nginx + security headers on every location ... - base image -> nginxinc/nginx-unprivileged:1.28-alpine, digest-pinned (BREAKING for the docker path: container port 80 -> 8080; compose mapping/healthcheck updated in the same change, cap_add dropped) - nginx add_header inheritance fix: shared snippets file re-included in every location that sets Cache-Control -- previously ALL security headers were dropped on real responses (verified live before/after) - server_tokens off; set_real_ip_from restricted to 127.0.0.1 - expires directives removed (duplicated Cache-Control); gzip_types text/html redundancy removed (nginx -t warn)	2026-07-05 14:10:55 +02:00