1b7bad1686
Auth hardening: - payments: per-customer JWT authorization on dual-use /payments routes (balance/methods/invoice/checkout/setup/portal/toggle-ppa) via authorizeCustomer + PAYMENTS_AUTH=enforce; portal retains+sends magic-link JWT (sessionStorage) - hub: fail-closed Stripe webhook, /accept/doc-pdf IDOR gate, telephony field-name guard (SQLi), modem-bridge private-IP guard (SSRF), ALWAYS_ENFORCE expansion Leaked-credential cleanup (token already rotated in ERPNext): - de-hardcode ERPNext API token -> env in bulk_submit.py, import_items.py, apps/client/deploy.sh; placeholder in apps/ops/infra/nginx.conf (nginx injects) - ops prod build no longer bakes VITE_ERP_TOKEN (.env.production empty) - de-hardcode legacy DB password -> env in import_items.py - gitignore legacy migration PII exports (tsv/json) Conversations/UI: - floating (un-docked) conversation panel; full-width mailbox - per-message real sender from email headers; unified scroll; header spacing - campaign pre-send review (subject/from/channel), Gmail send channel, clone-as-draft Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
46 lines
1.6 KiB
Nginx Configuration File
46 lines
1.6 KiB
Nginx Configuration File
server {
|
|
listen 80;
|
|
server_name _;
|
|
root /usr/share/nginx/html;
|
|
index index.html;
|
|
|
|
resolver 127.0.0.11 valid=30s;
|
|
|
|
# ERPNext API proxy — token injected server-side (never in JS bundle)
|
|
# To rotate: edit this file + docker restart ops-frontend
|
|
location /api/ {
|
|
proxy_pass https://erp.gigafibre.ca;
|
|
proxy_ssl_verify off;
|
|
proxy_set_header Host erp.gigafibre.ca;
|
|
proxy_set_header Authorization "token __ERP_API_TOKEN__"; # injected at deploy — never commit a real token
|
|
proxy_set_header X-Authentik-Email $http_x_authentik_email;
|
|
proxy_set_header X-Authentik-Username $http_x_authentik_username;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
}
|
|
|
|
# NOTE: Ollama Vision proxy removed 2026-04-22 — invoice OCR and all
|
|
# barcode/equipment scans now go directly to targo-hub (Gemini 2.5 Flash).
|
|
# See docs/features/vision-ocr.md. The hub handles CORS + rate-limit, so no
|
|
# nginx pass-through is needed here.
|
|
|
|
# SPA fallback — all routes serve index.html
|
|
location / {
|
|
try_files $uri $uri/ /index.html;
|
|
}
|
|
|
|
# No cache for index.html and service worker
|
|
location = /index.html {
|
|
add_header Cache-Control "no-cache, no-store, must-revalidate";
|
|
}
|
|
location = /sw.js {
|
|
add_header Cache-Control "no-cache, no-store, must-revalidate";
|
|
}
|
|
|
|
# Cache static assets (30 days, immutable)
|
|
location /assets/ {
|
|
expires 30d;
|
|
add_header Cache-Control "public, immutable";
|
|
}
|
|
}
|