Pin image versions, keep security headers in one file

.github/workflows/docker.yml

@@ -23,7 +23,6 @@ jobs:
           images: ghcr.io/${{ github.repository_owner }}/openedx-status-web
           tags: |
             type=semver,pattern={{version}}
-            type=raw,value=latest,enable=${{ !contains(github.ref_name, '-') }}
       - uses: docker/build-push-action@v6
         with:
           context: .

Dockerfile

@@ -5,6 +5,7 @@ USER root
 RUN mkdir -p /var/cache/status-cache && chown 101:101 /var/cache/status-cache
 USER 101
 COPY nginx.conf /etc/nginx/conf.d/default.conf
+COPY security-headers.inc /etc/nginx/conf.d/security-headers.inc
 COPY index.html /usr/share/nginx/html/index.html
 COPY assets/ /usr/share/nginx/html/assets/
 EXPOSE 8080

README.md

@@ -15,11 +15,10 @@ The container listens on port 8080, runs as a non-root user, and answers `/healt
 ## Run it
 
     docker run -d --name status-web --network <network-with-status-api> -p 8080:8080 \
-      ghcr.io/abstract-tech/openedx-status-web:latest
+      ghcr.io/abstract-tech/openedx-status-web:0.1.2
 
-The easiest way is the Docker Compose file in the `deploy/` folder of
-[openedx-status-api](https://github.com/Abstract-Tech/openedx-status-api). It starts the API, this page
-and a proxy together. The image there is `ghcr.io/abstract-tech/openedx-status-web`.
+The easiest way is [openedx-status-deploy](https://github.com/Abstract-Tech/openedx-status-deploy). It starts
+the API, this page and a proxy together.
 
 To build it yourself: `docker build -t openedx-status-web .`
 

nginx.conf

@@ -17,9 +17,7 @@ server {
     root /usr/share/nginx/html;
     index index.html;
 
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header Referrer-Policy "no-referrer" always;
-    add_header Content-Security-Policy "default-src 'self'; style-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'" always;
+    include /etc/nginx/conf.d/security-headers.inc;
 
     location = /healthz { default_type text/plain; return 200 'ok'; }
 
@@ -38,17 +36,13 @@ server {
         proxy_next_upstream error timeout;
         proxy_hide_header Cache-Control;  # the API sends its own no-store; avoid a duplicate
         add_header Cache-Control "no-store" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-referrer" always;
-        add_header Content-Security-Policy "default-src 'self'; style-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'" always;
+        include /etc/nginx/conf.d/security-headers.inc;
     }
 
     # Missing assets are a real 404, not the index page. add_header is not inherited once a location sets its own.
     location /assets/ {
         try_files $uri =404;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-referrer" always;
-        add_header Content-Security-Policy "default-src 'self'; style-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'" always;
+        include /etc/nginx/conf.d/security-headers.inc;
     }
 
     # Only the exact root serves the page; any other unknown path is a 404 (relative asset URLs would break otherwise).

security-headers.inc

@@ -0,0 +1,3 @@
+add_header X-Content-Type-Options "nosniff" always;
+add_header Referrer-Policy "no-referrer" always;
+add_header Content-Security-Policy "default-src 'self'; style-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'" always;