summaryrefslogtreecommitdiff
path: root/nginx/snippets
AgeCommit message (Collapse)Author
2025-06-27treewide: build via nixOphestra
2025-05-08raise fetchpriority for important imagesDaniel Micay
This was detected by PageSpeed Insights as an issue and it makes sense to address it.
2023-07-13Change string markings for replacementssmdyv
2023-07-11drop legacy block-all-mixed-contentDaniel Micay
2023-07-10block WebRTC in Content Security PolicyDaniel Micay
2023-03-24drop configuration to clear legacy push cookieDaniel Micay
2023-03-06update Roboto fontsDaniel Micay
2023-02-10drop HTTP/2 Push support since Chromium dropped itDaniel Micay
This only improves performance for the initial page load by sending resources that are almost always needed before the client receives the preload headers and fetches them. It can degrade performance in some edge cases such as clients with web fonts disabled or if the session cookie is cleared without the cache being cleared. Clients can cancel the push transfers once they start receiving them, but it's wasteful. Safari and Firefox still support this feature but are likely to follow the lead of Chromium and drop support for it. Few websites are going to bother with it without Chromium support and usage is already dropping.
2022-10-11disable bluetooth in Permissions PolicyDaniel Micay
2022-10-11disable keyboard-map in Permissions PolicyDaniel Micay
2022-10-11disable local-fonts in Permissions PolicyDaniel Micay
2022-08-25remove legacy Expect-CT headerDaniel Micay
2022-08-25Add "Origin-Agent-Cluster" headerRohan Kumar
Hint to browsers that we prefer per-origin process isolation. This disables certain unsafe features regarding cross-origin same-site resource sharing. https://web.dev/origin-agent-cluster/#limitations Specification link: https://html.spec.whatwg.org/multipage/origin.html#origin-keyed-agent-clusters This is just a hint to browsers. Depending on resource availability, they may or may not actually allocate a process. For this reason, it's not a robust security feature although it is preferable. This header needs to be active on all pages from an origin for it to work.
2022-05-03drop configuration for clearing legacy push cookieDaniel Micay
2022-04-18add gamepad and speaker-selection to permissions policyJune
Signed-off-by: June <zanthed@riseup.net>
2021-12-11rename push cookie for clarityDaniel Micay
2021-12-11add preload/push for main page phone imageDaniel Micay
2021-12-10disable legacy X-XSS-Protection featureDaniel Micay
2021-12-05use http2_push instead of http2_push_preloadDaniel Micay
This avoids needing to conditionally add nopush to each preloaded resource in the Link header. There's also no support for pushing JavaScript modules via http2_push_preload since nginx doesn't have support for rel=modulepreload.
2021-12-04avoid sending unnecessary push cookieDaniel Micay
2021-11-24disable idle-detection in Permissions-PolicyDaniel Micay
2021-06-08mark Expect-CT as largely obsoleteDaniel Micay
2021-04-18disable unused Clipboard API featuresDaniel Micay
2021-04-18disable unused hid (WebHID API) featureDaniel Micay
2021-04-18disable unused serial (Web Serial API) featureDaniel Micay
2021-04-18disable interest-cohort featureDaniel Micay
2021-03-26enforce strict Trusted Types without policiesDaniel Micay
2021-03-23explicitly set SameSite for preload session cookieDaniel Micay
2021-02-15use once per session preload / pushDaniel Micay
2021-02-15use a single Link header for preloadingDaniel Micay
2021-02-15add preload headers for core fontsDaniel Micay
2021-01-26drop support for obsolete Feature-Policy headerDaniel Micay
This has been replaced by Permissions-Policy.
2021-01-23temporarily disable Trusted Types for web-installDaniel Micay
This can be enabled again when the zip library supports it.
2021-01-05add foundation for WebUSB-based install pageDaniel Micay
2020-12-31document deprecated/obsolete headersDaniel Micay
2020-11-14move TLS configuration into nginx.confDaniel Micay
2020-10-27add require-trusted-types-for 'script' to CSPDaniel Micay
2020-10-27add COOP / COEP headersDaniel Micay
2020-10-03add Permissions-Policy headerDaniel Micay
2020-09-27disable unused publickey-credentials-get featureDaniel Micay
2020-09-27remove unused Feature-Policy speaker directiveDaniel Micay
2020-09-27handle Feature-Policy standard renaming wake-lockDaniel Micay
2020-09-27drop (unfortunately) obsolete HPKP supportDaniel Micay
2020-07-22drop usage of report-uri for Expect-CT and CSPDaniel Micay
This has proven to be unhelpful and we don't need this kind of reporting with the simplicity of the site and policies.
2020-04-19stop pinning IdenTrust root that's on the way outDaniel Micay
2020-04-07switch HPKP backup pinsDaniel Micay
2020-04-05certbot-ocsp-fetcher for reliable OCSP staplingDaniel Micay
2020-04-01move nginx https setup into a snippetDaniel Micay
2020-04-01remove obsolete HPKP report-uri URLDaniel Micay
2020-04-01add nginx configurationDaniel Micay
generated by cgit v1.3.1 (git 2.54.0) at 2026-08-30 02:25:12 +0000