Compare commits

...

4 Commits

Author SHA1 Message Date
Eric Nemchik aa3f8bd0dd Merge branch 'master' into deny-dotfile-access 2026-05-05 16:59:17 -05:00
Eric Nemchik 22bafef661 Move dotfile denial up
Signed-off-by: Eric Nemchik <eric@nemchik.com>
2026-05-05 16:44:32 -05:00
LinuxServer-CI b7ea5c43ec Bot Updating Package Versions 2026-05-02 05:43:26 +00:00
Eric Nemchik 716b1237c5 Update default.conf.sample to deny dotfile access
Signed-off-by: Eric Nemchik <eric@nemchik.com>
2026-02-08 09:39:37 -06:00
3 changed files with 36 additions and 22 deletions
+13 -12
View File
@@ -15,15 +15,15 @@ argon2-libs 20190702-r5 apk
attrs 26.1.0 python
autocommand 2.2.2 python
azure-common 1.1.28 python
azure-core 1.39.0 python
azure-core 1.40.0 python
azure-identity 1.25.3 python
azure-mgmt-core 1.6.0 python
azure-mgmt-dns 9.0.0 python
backports-tarfile 1.2.0 python
bash 5.2.37-r0 apk
beautifulsoup4 4.14.3 python
boto3 1.42.96 python
botocore 1.42.96 python
boto3 1.43.2 python
botocore 1.43.2 python
brotli-libs 1.1.0-r2 apk
bs4 0.0.2 python
busybox 1.37.0-r20 apk
@@ -96,7 +96,7 @@ coreutils-sha512sum 9.7-r1 apk
cryptography 47.0.0 python
curl 8.14.1-r2 apk
distro 1.9.0 python
dns-lexicon 3.23.2 python
dns-lexicon 3.25.1 python
dnslib 0.9.26 python
dnspython 2.8.0 python
domeneshop 0.4.4 python
@@ -119,10 +119,10 @@ gnupg-gpgconf 2.4.9-r0 apk
gnupg-keyboxd 2.4.9-r0 apk
gnupg-utils 2.4.9-r0 apk
gnupg-wks-client 2.4.9-r0 apk
gnutls 3.8.12-r0 apk
gnutls 3.8.13-r0 apk
google-api-core 2.30.3 python
google-api-python-client 2.194.0 python
google-auth 2.49.2 python
google-api-python-client 2.195.0 python
google-auth 2.50.0 python
google-auth-httplib2 0.3.1 python
googleapis-common-protos 1.74.0 python
gpg 2.4.9-r0 apk
@@ -134,7 +134,7 @@ gui UNKNOWN binary
gui-32 UNKNOWN binary
gui-64 UNKNOWN binary
gui-arm64 UNKNOWN binary
hcloud 2.18.0 python
hcloud 2.19.0 python
httplib2 0.31.2 python
icu-data-en 76.1-r1 apk
icu-libs 76.1-r1 apk
@@ -312,7 +312,7 @@ php84-xmlwriter 8.4.16-r0 apk
php84-xsl 8.4.16-r0 apk
php84-zip 8.4.16-r0 apk
pinentry 1.3.1-r0 apk
pip 26.0.1 python
pip 26.1 python
pkb-client 2.3.1 python
platformdirs 4.4.0 python
popt 1.19-r4 apk
@@ -341,7 +341,8 @@ readline 8.2.13-r1 apk
requests 2.33.1 python
requests-file 3.0.1 python
requests-mock 1.12.1 python
s3transfer 0.16.1 python
requests-unixsocket 0.4.1 python
s3transfer 0.17.0 python
scanelf 1.3.8-r1 apk
setuptools 82.0.1 python
shadow 4.17.3-r0 apk
@@ -362,8 +363,8 @@ utmps-libs 0.1.3.1-r0 apk
wheel 0.46.3 python
wheel 0.47.0 python
whois 5.6.3-r0 apk
xz-libs 5.8.1-r0 apk
xz-libs 5.8.3-r0 apk
zipp 3.23.0 python
zlib 1.3.2-r0 apk
zope-interface 8.3 python
zope-interface 8.4 python
zstd-libs 1.5.7-r0 apk
+1
View File
@@ -219,6 +219,7 @@ init_diagram: |
"swag:latest" <- Base Images
# changelog
changelogs:
- {date: "08.02.26:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) site-confs/default.conf - Deny access to all dotfiles."}
- {date: "23.01.26:", desc: "Reorder init to fix proxy conf version checks."}
- {date: "21.12.25:", desc: "Add support for hetzner-cloud dns validation."}
- {date: "04.11.25:", desc: "Switch default Gandi credentials from API Key to Token, allow DNS propagation time for Azure DNS plugin."}
@@ -1,4 +1,4 @@
## Version 2026/03/07 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/site-confs/default.conf.sample
## Version 2026/05/05 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/site-confs/default.conf.sample
# redirect all traffic to https
server {
@@ -13,9 +13,9 @@ server {
# main server block
server {
listen 443 ssl default_server;
# listen 443 quic reuseport default_server;
listen [::]:443 ssl default_server;
# listen [::]:443 quic reuseport default_server;
#listen 443 quic reuseport default_server;
#listen [::]:443 quic reuseport default_server;
server_name _;
@@ -24,6 +24,18 @@ server {
root /config/www;
index index.html index.htm index.php;
# Allow access to the ".well-known" directory
location ^~ /.well-known {
allow all;
}
# deny access to all dotfiles
location ~ /\. {
access_log off;
log_not_found off;
return 404;
}
# enable subfolder method reverse proxy confs
include /config/nginx/proxy-confs/*.subfolder.conf;
@@ -60,7 +72,7 @@ server {
}
location ~ ^(.+\.php)(.*)$ {
# enable the next two lines for http auth
# enable for basic auth
#auth_basic "Restricted";
#auth_basic_user_file /config/nginx/.htpasswd;
@@ -73,17 +85,17 @@ server {
# enable for Authentik (requires authentik-server.conf in the server block)
#include /config/nginx/authentik-location.conf;
# enable for Tinyauth (requires tinyauth-server.conf in the server block)
#include /config/nginx/tinyauth-location.conf;
fastcgi_split_path_info ^(.+\.php)(.*)$;
if (!-f $document_root$fastcgi_script_name) { return 404; }
if (!-f $document_root$fastcgi_script_name) {
return 404;
}
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
include /etc/nginx/fastcgi_params;
}
# deny access to .htaccess/.htpasswd files
location ~ /\.ht {
deny all;
}
}
# enable subdomain method reverse proxy confs