mirror of
https://github.com/gadgethd/ukmesh.git
synced 2026-09-09 16:45:33 +00:00
gadgethd
1ebc496965
* Fix map node freshness consistency * Harden output, ingest, caches, and WebSocket limits * Enforce public visibility across derived data * Harden proxy and operator deployment boundary * Make owner grants authoritative and reconcile ACLs safely * Bound path, spam, and statistics analysis * Make link and coverage jobs crash-safe * Implement strategic security remediation * Fix production cutover configuration * Fix disabled viewshed worker health signal * Serve stale stats during background refresh * Retain stale stats through refresh windows * Bound analytics work to protect ingestion * Prioritize summary warmup over chart scans * Throttle path history rebuilds * Bound path history result memory * Stream path history aggregation * Give bounded path rebuild one CPU * Serve stale charts during bounded refresh * Prioritize startup stats before chart scans * Bound path history segment cardinality * Pin path rebuild context to privacy generation * Self-host original frontend fonts * Allow bounded path rebuild to complete * Improve live map UI and low-latency group feed - Dock node details on the right with selection highlight and collapsible layers - Add node legend, 24h activity sparkline, copy-link, and layout/overlap fixes - Keep all repeaters visible during Live Path focus - Send GroupText feed packets immediately over WebSocket (no batch delay) - Cache expensive stats/observer activity more aggressively to protect ingest - Remove stale local planning/audit markdown from the tree * fix(ci): supply OPERATOR_SITE_TOKEN for compose validation Workers/Compose CI failed because docker-compose requires OPERATOR_SITE_TOKEN. Add CI placeholders for that and MQTT_PASSWORD.
9 lines
770 B
Plaintext
9 lines
770 B
Plaintext
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-Frame-Options "DENY" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
add_header Permissions-Policy "geolocation=(), camera=(), microphone=()" always;
|
|
add_header Cross-Origin-Opener-Policy "same-origin" always;
|
|
add_header Cross-Origin-Resource-Policy "same-origin" always;
|
|
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; connect-src 'self' wss: https:; font-src 'self' data:; worker-src 'self' blob:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'" always;
|