feat(nginx): block private key download #25

chris · 2026-08-05T15:45:31Z

chris commented

2026-08-05 15:45:31 +00:00

No description provided.

chris added 1 commit

2026-08-05 15:45:31 +00:00

feat(nginx): block private key download 62ed56a70b

irl requested changes

2026-08-05 20:25:13 +00:00

roles/podman_link/templates/home/nginx.conf Outdated

					
				@ -105,2 +105,4 @@

				    gzip_proxied any;

				  }

				  location /api/v1/integration/pgp/key_download/1 {

Is the "1" referencing some ID, and would be "2" if two keys were uploaded?

Can we use an if statement matching on both the query param and the path rather than overriding the location block?

Is the "1" referencing some ID, and would be "2" if two keys were uploaded? Can we use an if statement matching on both the query param and the path rather than overriding the location block?

chris marked this conversation as resolved

roles/podman_link/templates/home/nginx.conf Outdated

					
				@ -107,0 +108,4 @@

				  location /api/v1/integration/pgp/key_download/1 {

				    if ($arg_secret) {return 403;}  # Matches for presence of "secret" query param

				    try_files $uri /;   # Fallback to normal location

I think this won't fall back, we need the proxy directives, not looking for files.

Partially. This does fall back onto the / location but it didn't carry the $uri, I needed to add it after the /.

$uri /$uri would work but "" /$uri is marginally more robust.

Partially. This does fall back onto the `/` location but it didn't carry the `$uri`, I needed to add it after the `/`. `$uri /$uri` would work but `"" /$uri` is marginally more robust.

chris added 1 commit

2026-08-12 09:05:20 +00:00

fix: nginx pgp block b9044a9f36

- Removed "1" referring only to the first key.
- Corrected fallback: try_files looks for a file in the first arg then, on failure, uses the location for the second. The empty string will always fail so it will always use the location in the second arg.

acute commented

2026-08-12 09:29:37 +00:00

This looks good and I tested it by manually implementing the change onto help.sr2.

This pull request can be merged automatically.

This branch is out-of-date with the base branch

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin pgp-nginx:pgp-nginx

git switch pgp-nginx

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff pgp-nginx

git switch pgp-nginx

git rebase main

git switch main

git merge --ff-only pgp-nginx

git switch pgp-nginx

git rebase main

git switch main

git merge --no-ff pgp-nginx

git switch main

git merge --squash pgp-nginx