admin
13513583bc
Replaces the dead hand-rolled buildCsp() draft in next.config.ts (never wired in — its script-src had no 'unsafe-inline'/nonce, which blocked Next.js's own hydration script and blanked the whole app when tested live on 2026-08-10) with Clerk's official contentSecurityPolicy option on clerkMiddleware(). This is Clerk's documented workaround: its default directives already include the permissive script-src Next.js App Router needs, merged with our app-specific img-src/connect-src/media-src/ font-src/frame-ancestors/object-src/base-uri additions (Supabase, Mux, litix). Ships as Content-Security-Policy-Report-Only (reportOnly: true) with both reporting mechanisms wired to a new /api/csp-report route handler: Clerk's reportTo (Reporting API) and a classic report-uri (for browsers without Reporting API support). The route normalizes both report shapes, rate-limits by IP, and forwards violations to Sentry/GlitchTip as warnings — never blocks the request. Deliberately NOT enforced yet — move to reportOnly: false only after a clean observation period with zero unexpected violations. Gitea #5
49 lines
1.5 KiB
TypeScript
49 lines
1.5 KiB
TypeScript
import type { NextConfig } from "next";
|
|
import createNextIntlPlugin from "next-intl/plugin";
|
|
import { withSentryConfig } from "@sentry/nextjs";
|
|
|
|
const withNextIntl = createNextIntlPlugin("./src/i18n/request.ts");
|
|
|
|
function getSupabaseHostname(): string {
|
|
const url = process.env.NEXT_PUBLIC_SUPABASE_URL;
|
|
if (url) {
|
|
try { return new URL(url).hostname; } catch { /* fall through */ }
|
|
}
|
|
return "*.supabase.co";
|
|
}
|
|
|
|
const nextConfig: NextConfig = {
|
|
output: "standalone",
|
|
allowedDevOrigins: ["192.168.1.92"],
|
|
images: {
|
|
remotePatterns: [
|
|
{ protocol: "https", hostname: getSupabaseHostname() },
|
|
],
|
|
},
|
|
async headers() {
|
|
return [
|
|
{
|
|
source: "/(.*)",
|
|
headers: [
|
|
{ key: "X-Content-Type-Options", value: "nosniff" },
|
|
{ key: "X-Frame-Options", value: "DENY" },
|
|
{ key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
|
|
{ key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=()" },
|
|
{ key: "Strict-Transport-Security", value: "max-age=31536000; includeSubDomains" },
|
|
],
|
|
},
|
|
];
|
|
},
|
|
};
|
|
|
|
export default withSentryConfig(withNextIntl(nextConfig), {
|
|
org: process.env.SENTRY_ORG,
|
|
project: process.env.SENTRY_PROJECT,
|
|
authToken: process.env.SENTRY_AUTH_TOKEN,
|
|
silent: true,
|
|
// No auth token configured on this self-hosted deploy yet — skip
|
|
// source-map upload rather than failing the Docker build.
|
|
sourcemaps: { disable: !process.env.SENTRY_AUTH_TOKEN },
|
|
disableLogger: true,
|
|
});
|