From 08d253cdb678fd2c84908f555524ad786e788b43 Mon Sep 17 00:00:00 2001 From: Knowit Date: Sun, 3 May 2026 01:43:09 +0800 Subject: [PATCH] Deny access to .git, deploy/, and deploy-pull.sh Prevents leaking repo history, the docker-compose / nginx config, and the auto-pull script via the publicly served root. Co-Authored-By: Claude Opus 4.7 (1M context) --- deploy/nginx.conf | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/deploy/nginx.conf b/deploy/nginx.conf index e8f46bb..dfcafd7 100644 --- a/deploy/nginx.conf +++ b/deploy/nginx.conf @@ -7,6 +7,12 @@ server { charset utf-8; + # Deny access to repo metadata, deploy scripts/configs, and dotfiles + location ~ /\.git { deny all; return 404; } + location ~ /\. { deny all; return 404; } + location ^~ /deploy/ { deny all; return 404; } + location = /deploy-pull.sh { deny all; return 404; } + location = / { try_files /facere.html =404; }