From 7618b8e3a6e3b0b6e54390af7f95ab760b995fd6 Mon Sep 17 00:00:00 2001 From: Johan Bloemberg Date: Tue, 16 Jun 2026 22:33:29 +0200 Subject: [PATCH 1/2] Update gixy nginx config checker --- docker/webserver.Dockerfile | 4 +++- docker/webserver/nginx_templates/default.conf.template | 4 ++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/docker/webserver.Dockerfile b/docker/webserver.Dockerfile index a44025a4d..2d4014570 100644 --- a/docker/webserver.Dockerfile +++ b/docker/webserver.Dockerfile @@ -1,4 +1,5 @@ ARG CERTBOT_VERSION=5.6.0 +ARG GIXY_NG_VERSION=0.2.48 FROM nginx:1.31.2-alpine3.23 @@ -15,7 +16,8 @@ RUN apk upgrade --no-cache \ # install nginx config static analysis tool RUN python3 -m venv /opt/gixy -RUN /opt/gixy/bin/pip install gixy==0.1.21 +ARG GIXY_NG_VERSION +RUN /opt/gixy/bin/pip install gixy-ng==${GIXY_NG_VERSION} # install certbot RUN python3 -m venv /opt/certbot diff --git a/docker/webserver/nginx_templates/default.conf.template b/docker/webserver/nginx_templates/default.conf.template index c9dc5112f..b03e3b3fe 100644 --- a/docker/webserver/nginx_templates/default.conf.template +++ b/docker/webserver/nginx_templates/default.conf.template @@ -294,6 +294,7 @@ server { # monitoring, requires authentication, override headers, since CSP is too strict location /grafana { + add_header_inherit off; include http.headers; include hsts_h3.headers; auth_basic "Please enter your monitoring username and password"; @@ -303,6 +304,7 @@ server { proxy_pass $grafana; } location /prometheus { + add_header_inherit off; include http.headers; include hsts_h3.headers; auth_basic "Please enter your monitoring username and password"; @@ -312,6 +314,7 @@ server { proxy_pass $prometheus; } location /alertmanager { + add_header_inherit off; include http.headers; include hsts_h3.headers; auth_basic "Please enter your monitoring username and password"; @@ -323,6 +326,7 @@ server { # routinator proxy for internal use on multi instance setups location /routinator/ { + add_header_inherit off; include http.headers; include hsts_h3.headers; From 6a74c6aa2a5e76528497d4dea0f539cd31f6c65d Mon Sep 17 00:00:00 2001 From: "Benjamin W. Broersma" Date: Wed, 24 Jun 2026 16:04:57 +0200 Subject: [PATCH 2/2] Skip some gixy checks sed -ir '/add_header_inherit/d' docker/webserver/nginx_templates/default.conf.template --- Makefile | 4 ++-- docker/webserver/nginx_templates/default.conf.template | 4 ---- 2 files changed, 2 insertions(+), 6 deletions(-) diff --git a/Makefile b/Makefile index 2d4125dde..196301b75 100644 --- a/Makefile +++ b/Makefile @@ -311,8 +311,8 @@ fix: ## fix trivial linting error automatically ${DOCKER_COMPOSE_TOOLS_CMD} run --rm tools bin/lint.sh ${pysrcdirs} check-gixy: env=test -check-gixy: ## run nginx config check - ${DOCKER_COMPOSE_CMD} exec webserver /opt/gixy/bin/gixy /etc/nginx/nginx.conf +check-gixy: ## run nginx config check, skip the checks HSTS max-age=0 and header redefinitions + ${DOCKER_COMPOSE_CMD} exec webserver /opt/gixy/bin/gixy --skips hsts_header,add_header_redefinition /etc/nginx/nginx.conf build-tools tools-build: ## build tools image ${DOCKER_COMPOSE_TOOLS_CMD} build tools diff --git a/docker/webserver/nginx_templates/default.conf.template b/docker/webserver/nginx_templates/default.conf.template index b03e3b3fe..c9dc5112f 100644 --- a/docker/webserver/nginx_templates/default.conf.template +++ b/docker/webserver/nginx_templates/default.conf.template @@ -294,7 +294,6 @@ server { # monitoring, requires authentication, override headers, since CSP is too strict location /grafana { - add_header_inherit off; include http.headers; include hsts_h3.headers; auth_basic "Please enter your monitoring username and password"; @@ -304,7 +303,6 @@ server { proxy_pass $grafana; } location /prometheus { - add_header_inherit off; include http.headers; include hsts_h3.headers; auth_basic "Please enter your monitoring username and password"; @@ -314,7 +312,6 @@ server { proxy_pass $prometheus; } location /alertmanager { - add_header_inherit off; include http.headers; include hsts_h3.headers; auth_basic "Please enter your monitoring username and password"; @@ -326,7 +323,6 @@ server { # routinator proxy for internal use on multi instance setups location /routinator/ { - add_header_inherit off; include http.headers; include hsts_h3.headers;