Update default.conf.sample to deny dotfile access#41
Conversation
Signed-off-by: Eric Nemchik <eric@nemchik.com>
|
I am a bot, here are the test results for this PR:
|
|
I am a bot, here are the test results for this PR:
|
|
I am a bot, here are the test results for this PR:
|
|
I am a bot, here are the test results for this PR:
|
Signed-off-by: Eric Nemchik <eric@nemchik.com>
There was a problem hiding this comment.
Pull request overview
This PR updates the default nginx site configuration sample to better protect sensitive “dotfiles” from direct HTTP access, while explicitly allowing access to /.well-known paths (commonly used for ACME challenges and similar well-known resources).
Changes:
- Added an explicit allow rule for
/.well-known. - Added a deny rule returning 404 for all other dotfile paths (replacing the narrower
.ht*deny). - Updated the documentation changelog and refreshed the config version header.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| root/defaults/nginx/site-confs/default.conf.sample | Adds /.well-known allow and a broader dotfile deny rule; minor formatting/version updates. |
| readme-vars.yml | Documents the migration note advising existing users to update their nginx site conf. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| # deny access to all dotfiles | ||
| location ~ /\. { | ||
| access_log off; | ||
| log_not_found off; |
| index index.html index.htm index.php; | ||
|
|
||
| # Allow access to the ".well-known" directory | ||
| location ^~ /.well-known { |
|
I am a bot, here are the test results for this PR:
|
No description provided.