lockbitchat
c98a01b1d5
- Record voice notes in-browser, sent over the chunked AES-GCM file-transfer channel (per-file session key + signed SHA-256 integrity). - Captured as PCM and encoded to WAV for universal playback (incl. iOS/Safari); auto-accepted and played inline from an in-memory blob, never written to disk. - Composer mic button with live waveform + timer; desktop shows mic + send side by side, mobile swaps mic to send when typing. - CSP media-src now allows blob: so recorded/received audio can play. - Roadmap: Desktop Edition -> 5.0, new 5.5 'Secure Voice & Calls', later milestones shifted; version bumped to 5.4.5. - Update README, docs (security/API/cryptography), and CHANGELOG.
108 lines
5.2 KiB
Nginx Configuration File
108 lines
5.2 KiB
Nginx Configuration File
# nginx config for serving SecureBit.chat (static PWA) on Fly.io.
|
|
# Mirrors the behavior of the Apache .htaccess: correct JS MIME for ES modules
|
|
# (.jsx/.mjs), no-cache for the app shell / service worker / versioning files,
|
|
# long-immutable cache for hashed/static assets, security headers, SPA fallback.
|
|
|
|
worker_processes auto;
|
|
events { worker_connections 1024; }
|
|
|
|
http {
|
|
include /etc/nginx/mime.types;
|
|
default_type application/octet-stream;
|
|
|
|
# ES modules must be served as JavaScript. nginx's default mime.types maps
|
|
# .js but not .mjs/.jsx — declare them explicitly (this overrides .js too).
|
|
types {
|
|
application/javascript js mjs jsx;
|
|
text/css css;
|
|
application/json json map;
|
|
application/manifest+json webmanifest;
|
|
font/woff2 woff2;
|
|
font/woff woff;
|
|
image/svg+xml svg;
|
|
}
|
|
|
|
sendfile on;
|
|
tcp_nopush on;
|
|
server_tokens off;
|
|
|
|
gzip on;
|
|
gzip_vary on;
|
|
gzip_proxied any;
|
|
gzip_comp_level 6;
|
|
gzip_min_length 256;
|
|
gzip_types text/plain text/css text/javascript
|
|
application/javascript application/json application/manifest+json
|
|
application/ld+json application/wasm
|
|
image/svg+xml image/x-icon font/woff2;
|
|
|
|
# Decide Cache-Control from the request path. Keeping all add_header calls at
|
|
# one level avoids nginx's header-inheritance reset between blocks.
|
|
map $uri $sb_cache {
|
|
default "public, max-age=31536000, immutable";
|
|
~^/index\.html$ "no-cache, no-store, must-revalidate";
|
|
~^/$ "no-cache, no-store, must-revalidate";
|
|
~^/sw\.js$ "no-cache, no-store, must-revalidate";
|
|
~^/manifest\.json$ "no-cache, no-store, must-revalidate";
|
|
~^/meta\.json$ "no-cache, no-store, must-revalidate";
|
|
# dist/ bundles are query-versioned (?v=) in index.html. "no-cache" forces
|
|
# revalidation on every load, but dropping "no-store" lets the browser reuse
|
|
# the cached copy on a 304 — avoiding a full re-download of the large bundles
|
|
# (e.g. qr-local.js ~1.2MB) when nothing changed, while still picking up
|
|
# new releases immediately.
|
|
~^/dist/ "no-cache, must-revalidate";
|
|
}
|
|
|
|
# CDN-Cache-Control is read by Cloudflare (and other CDNs) *independently* of the
|
|
# browser Cache-Control above, and takes precedence at the edge. We force "no-store"
|
|
# for the app shell, service worker and version files so a CDN can never serve a
|
|
# stale meta.json / index.html / sw.js — which would silently break the in-app
|
|
# update notification. The empty default emits no header (nginx skips empty values),
|
|
# so immutable hashed assets keep being edge-cached normally for performance.
|
|
map $uri $sb_cdn_cache {
|
|
default "";
|
|
~^/index\.html$ "no-store";
|
|
~^/$ "no-store";
|
|
~^/sw\.js$ "no-store";
|
|
~^/manifest\.json$ "no-store";
|
|
~^/meta\.json$ "no-store";
|
|
~^/dist/ "no-store";
|
|
}
|
|
|
|
server {
|
|
listen 8080;
|
|
listen [::]:8080;
|
|
server_name _;
|
|
root /usr/share/nginx/html;
|
|
index index.html;
|
|
|
|
# Security headers (frame-ancestors complements the in-page CSP meta tag).
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
add_header X-Frame-Options "DENY" always;
|
|
add_header Content-Security-Policy "frame-ancestors 'none';" always;
|
|
# Force HTTPS for two years and preload, closing the first-visit SSL-strip
|
|
# window that upgrade-insecure-requests alone does not cover.
|
|
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
|
|
# Lock down powerful features. Camera is allowed for in-page QR scanning;
|
|
# microphone/geolocation and other sensors are denied outright.
|
|
add_header Permissions-Policy "camera=(self), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()" always;
|
|
add_header Cache-Control $sb_cache always;
|
|
# Edge-cache directive for Cloudflare/CDNs (empty value → header is omitted).
|
|
add_header CDN-Cache-Control $sb_cdn_cache always;
|
|
add_header Service-Worker-Allowed "/" always;
|
|
|
|
# Real asset files must return 404 when missing — never fall back to the
|
|
# HTML shell, which would be served with the wrong content type and break
|
|
# module/script loading (e.g. a missing config/ice-servers.js).
|
|
location ~* \.(js|mjs|jsx|css|json|map|woff2?|ttf|otf|png|jpe?g|gif|webp|svg|ico|mp3|mp4|webm)$ {
|
|
try_files $uri =404;
|
|
}
|
|
|
|
# SPA-style fallback so unknown navigation routes still load the app shell.
|
|
location / {
|
|
try_files $uri $uri/ /index.html;
|
|
}
|
|
}
|
|
}
|