root@my:~# yunohost tools regen-conf nginx --dry-run --with-diff
Warning: The configuration file '/etc/nginx/conf.d/yunohost_panel.conf.inc' has been manually modified and will not be updated
Warning: The configuration file '/etc/nginx/conf.d/security.conf.inc' has been manually modified and will not be updated
nginx:
applied:
pending:
/etc/nginx/conf.d/security.conf.inc:
diff: @@ -13,7 +13,7 @@
# Pre-defined FFDHE group (RFC 7919)
# From https://ssl-config.mozilla.org/ffdhe2048.txt
# https://security.stackexchange.com/a/149818
-ssl_dhparam /usr/share/yunohost/other/ffdhe2048.pem;
+ssl_dhparam /usr/share/yunohost/ffdhe2048.pem;
@@ -22,13 +22,13 @@
# https://observatory.mozilla.org/
more_set_headers "Content-Security-Policy : upgrade-insecure-requests";
-more_set_headers "Content-Security-Policy-Report-Only : default-src https: data: blob: ; object-src https: data: 'unsafe-inline'; style-src https: data: 'unsafe-inline' ; script-src https: data: 'unsafe-inline' 'unsafe-eval'";
+more_set_headers "Content-Security-Policy-Report-Only : default-src https: wss: data: blob: ; object-src https: data: 'unsafe-inline'; style-src https: data: 'unsafe-inline' ; script-src https: data: 'unsafe-inline' 'unsafe-eval'";
more_set_headers "X-Content-Type-Options : nosniff";
more_set_headers "X-XSS-Protection : 1; mode=block";
more_set_headers "X-Download-Options : noopen";
more_set_headers "X-Permitted-Cross-Domain-Policies : none";
-# more_set_headers "X-Frame-Options : SAMEORIGIN";
+more_set_headers "X-Frame-Options : SAMEORIGIN";
# Disable the disaster privacy thing that is FLoC
status: modified
/etc/nginx/conf.d/yunohost_panel.conf.inc:
diff: @@ -0,0 +1,8 @@
+# Insert YunoHost button + portal overlay
+sub_filter </head> '<script type="text/javascript" src="/ynh_portal.js"></script><link type="text/css" rel="stylesheet" href="/ynh_overlay.css"><script type="text/javascript" src="/ynhtheme/custom_portal.js"></script><link type="text/css" rel="stylesheet" href="/ynhtheme/custom_overlay.css"></head>';
+sub_filter_once on;
+# Apply to other mime types than text/html
+sub_filter_types application/xhtml+xml;
+# Prevent YunoHost panel files from being blocked by specific app rules
+location ~ (ynh_portal.js|ynh_overlay.css|ynh_userinfo.json|ynhtheme/custom_portal.js|ynhtheme/custom_overlay.css) {
+}
status: modified
root@my:~#
root@my:~# yunohost tools regen-conf nginx --force
Success! Configuration updated for 'nginx'
Warning: -- Journal begins at Thu 2022-08-11 19:57:44 BST, ends at Sun 2022-08-14 20:33:32 BST. --
Warning: Aug 14 13:54:12 my.domain.tld nginx[28128]: nginx: configuration file /etc/nginx/nginx.conf test failed
Warning: Aug 14 13:54:12 my.domain.tld systemd[1]: nginx.service: Control process exited, code=exited, status=1/FAILURE
Warning: Aug 14 13:54:12 my.domain.tld systemd[1]: nginx.service: Failed with result 'exit-code'.
Warning: Aug 14 13:54:12 my.domain.tld systemd[1]: Failed to start A high performance web server and a reverse proxy server.
Warning: -- Boot 972782aaa138491ba546bce468f86314 --
Warning: Aug 14 14:17:07 my.domain.tld systemd[1]: Starting A high performance web server and a reverse proxy server...
Warning: Aug 14 14:17:09 my.domain.tld nginx[715]: nginx: [emerg] BIO_new_file("/usr/share/yunohost/other/ffdhe2048.pem") failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen('/usr/share/yunohost/other/ffdhe2048.pem','r') error:2006D080:BIO routines:BIO_new_file:no such file)
Warning: Aug 14 14:17:09 my.domain.tld nginx[715]: nginx: configuration file /etc/nginx/nginx.conf test failed
Warning: Aug 14 14:17:09 my.domain.tld systemd[1]: nginx.service: Control process exited, code=exited, status=1/FAILURE
Warning: Aug 14 14:17:09 my.domain.tld systemd[1]: nginx.service: Failed with result 'exit-code'.
Warning: Aug 14 14:17:09 my.domain.tld systemd[1]: Failed to start A high performance web server and a reverse proxy server.
Error: Could not run script: /usr/share/yunohost/hooks/conf_regen/15-nginx
nginx:
applied:
/etc/nginx/conf.d/security.conf.inc:
status: force-updated
/etc/nginx/conf.d/yunohost_panel.conf.inc:
status: force-updated
pending: