TehRiehlDeal
ca3862d5a7
BREAKING CHANGE: the production container listens on 8080 instead of 80. nginx now runs as an unprivileged user and cannot bind a privileged port without CAP_NET_BIND_SERVICE, which compose drops. Anything routing to this container must be repointed - in the homelab Traefik config, traefik.http.services.movieloop.loadbalancer.server.port 80 -> 8080. nginx's add_header is not additive across levels: a block declaring any add_header of its own discards every header inherited from its parent. Both /assets/ and /config.js declared one, so X-Frame-Options, X-Content-Type-Options and Referrer-Policy were silently absent from every JavaScript and CSS response. The headers now come from a snippet included in each location - verified 6/6 on /, on a hashed asset bundle, and on /config.js. Adds a CSP, HSTS and Permissions-Policy. connect-src is derived at container start from API_URL, because the API is deliberately not same-origin in production; asserting same-origin would have broken the deployment outright. The inline theme script is allowed by SHA-256 hash rather than unsafe-inline, which would have bought almost nothing - editing that script means regenerating the hash. config.js is also no longer rendered with envsubst, which does no escaping: an API_URL containing a double quote closed the JS string literal and the remainder executed on every page load. Addresses M31, M34.
53 lines
1.5 KiB
JSON
53 lines
1.5 KiB
JSON
{
|
|
"name": "frontend-temp",
|
|
"private": true,
|
|
"version": "2.0.0",
|
|
"type": "module",
|
|
"license": "MIT",
|
|
"author": "Kevin Riehl",
|
|
"scripts": {
|
|
"dev": "vite",
|
|
"build": "tsc -b && vite build",
|
|
"lint": "eslint . --max-warnings 0",
|
|
"preview": "vite preview",
|
|
"release": "commit-and-tag-version",
|
|
"release:minor": "commit-and-tag-version --release-as minor",
|
|
"release:major": "commit-and-tag-version --release-as major",
|
|
"release:dry": "commit-and-tag-version --dry-run"
|
|
},
|
|
"dependencies": {
|
|
"@base-ui/react": "^1.2.0",
|
|
"@fontsource-variable/geist": "^5.2.8",
|
|
"axios": "^1.13.6",
|
|
"class-variance-authority": "^0.7.1",
|
|
"clsx": "^2.1.1",
|
|
"lucide-react": "^0.577.0",
|
|
"react": "^19.2.0",
|
|
"react-dom": "^19.2.0",
|
|
"react-router": "^7.13.1",
|
|
"socket.io-client": "^4.8.3",
|
|
"sonner": "^2.0.7",
|
|
"tailwind-merge": "^3.5.0",
|
|
"zustand": "^5.0.11"
|
|
},
|
|
"devDependencies": {
|
|
"@eslint/js": "^9.39.1",
|
|
"@tailwindcss/vite": "^4.2.1",
|
|
"@types/node": "^24.10.1",
|
|
"@types/react": "^19.2.7",
|
|
"@types/react-dom": "^19.2.3",
|
|
"@vitejs/plugin-react": "^5.1.1",
|
|
"commit-and-tag-version": "^12.5.0",
|
|
"eslint": "^9.39.1",
|
|
"eslint-plugin-react-hooks": "^7.0.1",
|
|
"eslint-plugin-react-refresh": "^0.4.24",
|
|
"globals": "^16.5.0",
|
|
"shadcn": "^4.0.0",
|
|
"tailwindcss": "^4.2.1",
|
|
"tw-animate-css": "^1.4.0",
|
|
"typescript": "~5.9.3",
|
|
"typescript-eslint": "^8.48.0",
|
|
"vite": "^7.3.1"
|
|
}
|
|
}
|