diff --git a/Dockerfile b/Dockerfile index 71097ddbec6f2533bda1b27ac105a72857e8d0db..daa4619437badcde19dd71f029c5c2c4e9893210 100644 --- a/Dockerfile +++ b/Dockerfile @@ -86,7 +86,8 @@ RUN touch /var/run/nginx.pid \ && echo "export TMOUT=1800 readonly TMOUT" >> /etc/profile \ && rm -rf /usr/bin/gdb* \ && rm -rf /usr/share/gdb \ - && rm -rf /usr/share/gcc-10.3.1 \ + && rm -rf /usr/share/gcc-12 \ + && rm -rf /usr/lib64/python3.11/pdb.py \ && yum remove gdb-gdbserver findutils passwd shadow -y COPY ./deploy/monitor.sh ./deploy/entrypoint.sh /etc/nginx/ diff --git a/deploy/nginx/nginx.conf b/deploy/nginx/nginx.conf index 4c8696eb010d93bfcb3094e6b0ac5e0b9fb9f99e..ae33768290e616326395645e60d282671ecf7a7d 100644 --- a/deploy/nginx/nginx.conf +++ b/deploy/nginx/nginx.conf @@ -54,16 +54,7 @@ http { server { listen 8080 ssl default_server; server_name easysoftware.openeuler.org; - charset utf-8; - - add_header X-XSS-Protection "1; mode=block"; - add_header X-Frame-Options DENY; - add_header X-Content-Type-Options nosniff; - add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; - add_header Content-Security-Policy "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://hm.baidu.com/; object-src 'none'; frame-src 'none'"; - add_header Cache-Control "no-cache,no-store,must-revalidate"; - add_header Pragma no-cache; - add_header Expires 0; + charset utf-8; limit_conn limitperip 10; ssl_session_tickets off; @@ -98,19 +89,25 @@ http { proxy_set_header X-Forwarded-For $http_x_real_ip; proxy_set_header Host $host; + add_header X-XSS-Protection "1; mode=block"; + add_header X-Frame-Options DENY; + add_header X-Content-Type-Options nosniff; + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; + add_header Content-Security-Policy "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://hm.baidu.com/; object-src 'none'; frame-src 'none'"; + add_header Cache-Control "no-cache,no-store,must-revalidate"; + add_header Pragma no-cache; + add_header Expires 0; + location /assets { add_header X-XSS-Protection "1; mode=block"; add_header X-Frame-Options DENY; add_header X-Content-Type-Options nosniff; add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; - add_header Content-Security-Policy "script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'none'; frame-src 'none'"; + add_header Content-Security-Policy "script-src 'self' 'unsafe-inline' 'unsafe-eval'; object-src 'none'; frame-src 'none'"; add_header Cache-Control "public,max-age=1209600"; } - - location / { - try_files $uri /index.html; - } - + + try_files $uri /index.html; root /usr/share/nginx/www; index index.html; } @@ -171,26 +168,15 @@ http { proxy_pass https://omapi.osinfra.cn/; } - location /api-ip/ { - proxy_set_header X-Forwarded-For $http_x_real_ip; - add_header X-XSS-Protection "1; mode=block"; - add_header X-Frame-Options DENY; - add_header X-Content-Type-Options nosniff; - add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; - add_header Content-Security-Policy "script-src 'self'; object-src 'none'; frame-src 'none'"; - add_header Cache-Control "no-cache,no-store,must-revalidate"; - add_header Pragma no-cache; - add_header Expires 0; - - proxy_pass http://ip-api.com/json/; - } - - error_page 401 402 403 405 406 407 413 414 /error.html; error_page 500 501 502 503 504 505 /error.html; error_page 404 /index.html; - location = /error.html { + location = /404.html { + root /usr/share/nginx/www; + } + + location = /error.html { root /usr/share/nginx/www; } }