Restructure in-progress

2025-07-04 23:48:04 -04:00
parent 32aad50820
commit 36de65ba60
114 changed files with 670 additions and 1041 deletions
@@ -0,0 +1,47 @@
+server {
+    listen 80;
+    listen [::]:80;
+    server_name {{ tracker_domain }};
+
+    # Redirect to HTTPS if SSL is enabled
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name {{ tracker_domain }};
+    
+    # SSL Configuration
+    ssl_certificate /etc/letsencrypt/live/{{ tracker_domain }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ tracker_domain }}/privkey.pem;
+    
+    # Restrict dashboard to localhost only
+    location / {
+        allow 127.0.0.1;
+        deny all;
+        proxy_pass http://127.0.0.1:5000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    }
+    
+    # Allow public access only to pixel endpoints
+    location ~ ^/pixel/(.+)\.png$ {
+        # Public access allowed
+        proxy_pass http://127.0.0.1:5000/pixel/$1.png;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        
+        # Cache control - don't cache tracking pixels
+        add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
+        expires off;
+    }
+    
+    # Security headers
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Referrer-Policy "no-referrer" always;
+}