javier
6b6389cb0f
This PR contains the work done to add a `SecurityHeadersMiddleware` middleware that stamps hardened security-related HTTP headers onto every response. To provide further details about the work: * Implemented the `SecurityHeadersMiddleware` middleware, which precomputes headers once from a `Configuration` object and applies them to every response: * _Content-Security-Policy_, * _X-Content-Type-Options_, * _X-Frame-Options_, * _Referrer-Policy_, * _Permissions-Policy_, * _Strict-Transport-Security_ (optional). * Integrated this middleware into the router (near the top of the chain), reading each value from configuration with hardened defaults. * The _Strict-Transport-Security_ has no default value — omitted unless explicitly set, so it stays off in plain-HTTP during development and on only behind TLS. * Added security-header constants keys and values. Reviewed-on: rock-n-code/loud-amsterdam#8 Co-authored-by: Javier Cicchelli <javier@rock-n-code.com> Co-committed-by: Javier Cicchelli <javier@rock-n-code.com>
24 lines
886 B
YAML
24 lines
886 B
YAML
name: loud-platform
|
|
|
|
# Production base configuration.
|
|
# Deploys a pre-built image pulled from a registry — no build step.
|
|
#
|
|
# docker compose -f docker-compose.yml pull
|
|
# docker compose -f docker-compose.yml up -d
|
|
#
|
|
# The `-f docker-compose.yml` flag is important in production: it skips the
|
|
# docker-compose.override.yml file, which Compose would otherwise merge in
|
|
# automatically for local development.
|
|
services:
|
|
website:
|
|
image: ${HOST_CONTAINER}/${HOST_OWNER}/${IMAGE_NAME}:${IMAGE_TAG:-latest}
|
|
platform: linux/amd64
|
|
container_name: ${HOST_OWNER}-${IMAGE_NAME}
|
|
restart: unless-stopped
|
|
ports:
|
|
- "${HOST_PORT:-8080}:8080"
|
|
environment:
|
|
LOG_LEVEL: ${LOG_LEVEL:-info}
|
|
HTTP_SERVER_NAME: ${HTTP_SERVER_NAME:-LoudWebsite}
|
|
SECURITY_STRICT_TRANSPORT_SECURITY: "${SECURITY_STRICT_TRANSPORT_SECURITY:-max-age=31536000; includeSubDomains}"
|