bert.hausmans
940297f214
API middleware: - SecurityHeaders now sets Content-Security-Policy from config/security.php - Default API policy: "default-src 'none'; frame-ancestors 'none'" - Supports report-only mode via CSP_REPORT_ONLY env var - Policy value configurable via CSP_POLICY env var Nginx deployment configs (deploy/nginx/): - security-headers.conf: shared headers for all server blocks - csp-api.conf: restrictive JSON-only policy for api.crewli.app - csp-spa.conf: SPA policy for app/admin (self + unsafe-inline styles) - csp-portal.conf: portal policy matching SPA Development: - CSP meta tags added to all three index.html files - Includes 'unsafe-inline' + 'unsafe-eval' for Vite HMR/loader script - Each app allows its own ws:// port for HMR websocket Resolves security finding A13-9. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1.6 KiB
1.6 KiB
Crewli Deployment — Security Configuration
Nginx Security Headers
Copy the configuration snippets to your Nginx server:
API (api.crewli.app)
server {
server_name api.crewli.app;
include /path/to/deploy/nginx/security-headers.conf;
include /path/to/deploy/nginx/csp-api.conf;
# ... rest of config
}
Organizer App (app.crewli.app)
server {
server_name app.crewli.app;
include /path/to/deploy/nginx/security-headers.conf;
include /path/to/deploy/nginx/csp-spa.conf;
# ... rest of config
}
Admin (admin.crewli.app)
server {
server_name admin.crewli.app;
include /path/to/deploy/nginx/security-headers.conf;
include /path/to/deploy/nginx/csp-spa.conf;
# ... rest of config
}
Portal (portal.crewli.app)
server {
server_name portal.crewli.app;
include /path/to/deploy/nginx/security-headers.conf;
include /path/to/deploy/nginx/csp-portal.conf;
# ... rest of config
}
CSP Rollout Process
- Start with
Content-Security-Policy-Report-Only(uncomment incsp-spa.conf) - Monitor browser console for CSP violations for 1-2 weeks
- Add any missing sources to the policy
- Switch to enforcing
Content-Security-Policy - Monitor for false positives after enforcement
DirectAdmin Integration
If using DirectAdmin with Nginx:
- Place the
.conffiles in/usr/local/directadmin/data/users/USERNAME/nginx.confor use DirectAdmin's custom Nginx configuration feature - Reload Nginx:
service nginx reload - Verify headers:
curl -I https://app.crewli.app | grep -i security