From 6f3e3ef04c9da271898b68ea982d714bf69c8a83 Mon Sep 17 00:00:00 2001
From: Ronak Pansuriya <ronakpansuriya0@gmail.com>
Date: Mon, 2 Nov 2026 13:10:51 +0100
Subject: [PATCH] Pin image versions, keep security headers in one file

- no more floating latest tag in CI or README
- the nginx security headers live in security-headers.inc instead of four copies
---
 .github/workflows/docker.yml |  1 -
 Dockerfile                   |  1 +
 README.md                    |  7 +++----
 nginx.conf                   | 12 +++---------
 security-headers.inc         |  3 +++
 5 files changed, 10 insertions(+), 14 deletions(-)
 create mode 100644 security-headers.inc

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 113453f..87f905b 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -23,7 +23,6 @@ jobs:
           images: ghcr.io/${{ github.repository_owner }}/openedx-status-web
           tags: |
             type=semver,pattern={{version}}
-            type=raw,value=latest,enable=${{ !contains(github.ref_name, '-') }}
       - uses: docker/build-push-action@v6
         with:
           context: .
diff --git a/Dockerfile b/Dockerfile
index 2811954..4360aa7 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -5,6 +5,7 @@ USER root
 RUN mkdir -p /var/cache/status-cache && chown 101:101 /var/cache/status-cache
 USER 101
 COPY nginx.conf /etc/nginx/conf.d/default.conf
+COPY security-headers.inc /etc/nginx/conf.d/security-headers.inc
 COPY index.html /usr/share/nginx/html/index.html
 COPY assets/ /usr/share/nginx/html/assets/
 EXPOSE 8080
diff --git a/README.md b/README.md
index c61d22d..f918a52 100644
--- a/README.md
+++ b/README.md
@@ -15,11 +15,10 @@ The container listens on port 8080, runs as a non-root user, and answers `/healt
 ## Run it
 
     docker run -d --name status-web --network <network-with-status-api> -p 8080:8080 \
-      ghcr.io/abstract-tech/openedx-status-web:latest
+      ghcr.io/abstract-tech/openedx-status-web:0.1.2
 
-The easiest way is the Docker Compose file in the `deploy/` folder of
-[openedx-status-api](https://github.com/Abstract-Tech/openedx-status-api). It starts the API, this page
-and a proxy together. The image there is `ghcr.io/abstract-tech/openedx-status-web`.
+The easiest way is [openedx-status-deploy](https://github.com/Abstract-Tech/openedx-status-deploy). It starts
+the API, this page and a proxy together.
 
 To build it yourself: `docker build -t openedx-status-web .`
 
diff --git a/nginx.conf b/nginx.conf
index b880d98..825e548 100644
--- a/nginx.conf
+++ b/nginx.conf
@@ -17,9 +17,7 @@ server {
     root /usr/share/nginx/html;
     index index.html;
 
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header Referrer-Policy "no-referrer" always;
-    add_header Content-Security-Policy "default-src 'self'; style-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'" always;
+    include /etc/nginx/conf.d/security-headers.inc;
 
     location = /healthz { default_type text/plain; return 200 'ok'; }
 
@@ -38,17 +36,13 @@ server {
         proxy_next_upstream error timeout;
         proxy_hide_header Cache-Control;  # the API sends its own no-store; avoid a duplicate
         add_header Cache-Control "no-store" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-referrer" always;
-        add_header Content-Security-Policy "default-src 'self'; style-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'" always;
+        include /etc/nginx/conf.d/security-headers.inc;
     }
 
     # Missing assets are a real 404, not the index page. add_header is not inherited once a location sets its own.
     location /assets/ {
         try_files $uri =404;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-referrer" always;
-        add_header Content-Security-Policy "default-src 'self'; style-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'" always;
+        include /etc/nginx/conf.d/security-headers.inc;
     }
 
     # Only the exact root serves the page; any other unknown path is a 404 (relative asset URLs would break otherwise).
diff --git a/security-headers.inc b/security-headers.inc
new file mode 100644
index 0000000..4ac5824
--- /dev/null
+++ b/security-headers.inc
@@ -0,0 +1,3 @@
+add_header X-Content-Type-Options "nosniff" always;
+add_header Referrer-Policy "no-referrer" always;
+add_header Content-Security-Policy "default-src 'self'; style-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'" always;