sanspie
fac6fa35a4
ci-platforms / darwin arm64 smoke (push) Skipped
ci-platforms / windows amd64 smoke (push) Skipped
ci-platforms / darwin amd64 smoke (push) Skipped
github-native / gitea-pending (push) Skipped
github-native / darwin amd64 native (push) Skipped
github-native / linux amd64 native (push) Skipped
github-native / windows amd64 native (push) Skipped
github-native / darwin arm64 native (push) Skipped
github-native / gitea-result (push) Skipped
ci / checks (push) Failing after 7m29s
ci / build (amd64, linux, ubuntu-24.04) (push) Failing after 14m13s
ci / release (push) Skipped
GitHub / windows amd64 native GitHub-hosted native CI: failure
GitHub / darwin arm64 native GitHub-hosted native CI: error
GitHub / darwin amd64 native GitHub-hosted native CI: failure
GitHub / linux amd64 native GitHub-hosted native CI: success
Keep recovery copies private on Windows, make cross-platform test fixtures deterministic, and preserve the updated Art and documentation contracts. Refresh workspace screenshot references for the intentional factory layouts and restore the earlier Russian palette reference after before/after comparison. Keep the existing screenshot tolerances.
66 lines
3.0 KiB
Plaintext
66 lines
3.0 KiB
Plaintext
# Dedicated Asset Studio origin. Install only after the exact release artifact
|
|
# has passed its gates and been staged under this separate deployment root.
|
|
# The existing aego.akarpov.ru and default vhosts are not replaced.
|
|
map $uri $aeditor_cache {
|
|
default "no-cache";
|
|
"~\.[a-f0-9]{16}\.(js|css|wasm)(\.gz)?$" "public, max-age=31536000, immutable";
|
|
}
|
|
map $uri $aeditor_csp {
|
|
default "default-src 'none'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self'; font-src 'self'; object-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'";
|
|
~^/(r/[A-Za-z0-9._-]+/)?embed/ "default-src 'none'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self'; font-src 'self'; object-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors https://aego.akarpov.ru https://aeditor.akarpov.ru";
|
|
~^/(r/[A-Za-z0-9._-]+/)?docs/ "default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; frame-src https://aeditor.akarpov.ru blob:; object-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'";
|
|
}
|
|
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
server_name aeditor.akarpov.ru;
|
|
return 301 https://aeditor.akarpov.ru$request_uri;
|
|
}
|
|
server {
|
|
listen 443 ssl;
|
|
listen [::]:443 ssl;
|
|
listen 443 quic;
|
|
listen [::]:443 quic;
|
|
http2 on;
|
|
server_name aeditor.akarpov.ru;
|
|
ssl_certificate /etc/nginx/ssl/akarpov-wildcard/fullchain.pem;
|
|
ssl_certificate_key /etc/nginx/ssl/akarpov-wildcard/privkey.pem;
|
|
|
|
root /var/www/aego-asset-studio/current;
|
|
index index.html;
|
|
autoindex off;
|
|
server_tokens off;
|
|
# Query strings can contain transfer session tokens; never log them.
|
|
access_log off;
|
|
client_max_body_size 1k;
|
|
include /etc/nginx/mime.types;
|
|
default_type application/octet-stream;
|
|
gzip on;
|
|
gzip_static on;
|
|
gzip_vary on;
|
|
gzip_types application/wasm application/json text/javascript application/javascript text/css;
|
|
add_header Content-Security-Policy $aeditor_csp always;
|
|
add_header Cache-Control $aeditor_cache always;
|
|
add_header X-Content-Type-Options nosniff always;
|
|
add_header Referrer-Policy no-referrer always;
|
|
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
|
|
error_page 404 = @aeditor_not_found;
|
|
location ~ (^|/)\. { return 404; }
|
|
location /r/ {
|
|
alias /var/www/aego-asset-studio/releases/;
|
|
limit_except GET HEAD { deny all; }
|
|
}
|
|
location / {
|
|
try_files $uri $uri/index.html =404;
|
|
limit_except GET HEAD { deny all; }
|
|
}
|
|
location @aeditor_not_found {
|
|
types { }
|
|
default_type text/plain;
|
|
add_header Content-Security-Policy "default-src 'none'; frame-ancestors 'none'" always;
|
|
add_header Cache-Control "no-store" always;
|
|
add_header X-Content-Type-Options nosniff always;
|
|
return 404 "Asset Studio resource not found\n";
|
|
}
|
|
}
|