Block dotfile access, remove custom CSS, fix cron npm install

- nginx: deny all requests to hidden files (/.git/config was publicly readable)
- nginx: remove CSS injection and /custom/ static file serving
- cron: install script deps at build time into /opt to avoid ro mount conflict
- docker-compose: widen cron build context for package.json COPY
- Delete unused theme/ghost-guild.css
This commit is contained in:
Jennie Robinson Faber 2026-03-31 17:53:50 +01:00
parent 1984e64ccd
commit ed05044464
5 changed files with 9 additions and 85 deletions

View file

@ -40,13 +40,6 @@ http {
listen [::]:3200 default_server;
server_name wiki.ghostguild.org;
# Serve custom theme files
location /custom/ {
alias /opt/ghost-guild-wiki-theme/;
expires 1h;
add_header Cache-Control "public";
}
# Block access to hidden files (especially .git)
location ~ /\. {
deny all;
@ -76,9 +69,6 @@ http {
# OG tags after <head> so they appear before Outline's own tags
sub_filter '<head>' '<head><meta property="og:title" content="Ghost Guild Wiki" /><meta property="og:description" content="A living knowledge base for Baby Ghosts &amp; Ghost Guild." /><meta property="og:type" content="website" /><meta property="og:url" content="https://wiki.ghostguild.org" /><meta name="twitter:card" content="summary" /><meta name="twitter:title" content="Ghost Guild Wiki" /><meta name="twitter:description" content="A living knowledge base for Baby Ghosts &amp; Ghost Guild." />';
# CSS injection (must redeclare; sub_filter doesn't inherit across location blocks)
sub_filter '</head>' '<link rel="stylesheet" href="/custom/ghost-guild.css" /></head>';
sub_filter_once on;
sub_filter_types text/html;
}
@ -101,10 +91,6 @@ http {
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
# Inject custom CSS before </head>
sub_filter '</head>' '<link rel="stylesheet" href="/custom/ghost-guild.css" /></head>';
sub_filter_once on;
sub_filter_types text/html;
}
}
}