diff options
Diffstat (limited to 'deploy/code-host')
| -rw-r--r-- | deploy/code-host/README.md | 5 | ||||
| -rw-r--r-- | deploy/code-host/nginx-app.monzero.org.conf | 27 |
2 files changed, 32 insertions, 0 deletions
diff --git a/deploy/code-host/README.md b/deploy/code-host/README.md index a6a2827d9..581986b2c 100644 --- a/deploy/code-host/README.md +++ b/deploy/code-host/README.md @@ -14,3 +14,8 @@ Nginx exposes only `git-upload-pack`; it intentionally has no `git-receive-pack` route. After deployment, Certbot upgrades the virtual host to HTTPS and UFW admits ports 80 and 443. +`nginx-app.monzero.org.conf` separately serves the static Studio beta from +`/var/www/monzero-app` and exposes only the daemon's restricted `get_info` +method through a same-origin status endpoint. Token, NFT, collection, and swap +submission controls remain disabled until reviewed consensus and wallet RPC +support exists. diff --git a/deploy/code-host/nginx-app.monzero.org.conf b/deploy/code-host/nginx-app.monzero.org.conf new file mode 100644 index 000000000..776489630 --- /dev/null +++ b/deploy/code-host/nginx-app.monzero.org.conf @@ -0,0 +1,27 @@ +server { + listen 80; + listen [::]:80; + server_name app.monzero.org; + + root /var/www/monzero-app; + index index.html; + + add_header X-Content-Type-Options nosniff always; + add_header X-Frame-Options DENY always; + add_header Referrer-Policy no-referrer always; + add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always; + add_header Content-Security-Policy "default-src 'self'; connect-src 'self'; img-src 'self' data:; style-src 'self'; script-src 'self'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'" always; + + location = /api/node/get_info { + limit_except POST { deny all; } + proxy_pass http://127.0.0.1:6175/get_info; + proxy_set_header Content-Type application/json; + proxy_set_header Host 127.0.0.1; + proxy_connect_timeout 2s; + proxy_read_timeout 5s; + } + + location / { + try_files $uri $uri/ /index.html; + } +} |