100 lines
2.7 KiB
Go
100 lines
2.7 KiB
Go
// Copyright (C) 2026 VšĮ „0011.LT"
|
|
//
|
|
// This program is free software: you can redistribute it and/or modify
|
|
// it under the terms of the GNU Affero General Public License as published by
|
|
// the Free Software Foundation, version 3 ONLY.
|
|
//
|
|
// This program is distributed in the hope that it will be useful,
|
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
// GNU Affero General Public License for more details.
|
|
|
|
package main
|
|
|
|
import (
|
|
"flag"
|
|
"fmt"
|
|
"os"
|
|
"time"
|
|
)
|
|
|
|
// const default_csp = "" +
|
|
// "default-src 'self'; " +
|
|
// "base-uri 'self'; " +
|
|
// "object-src 'none'; " +
|
|
// "frame-ancestors 'none'; " +
|
|
// "img-src 'self' data:; " +
|
|
// "style-src 'self' 'unsafe-inline'; " +
|
|
// "script-src 'self'"
|
|
|
|
const default_csp = "" +
|
|
// core security restrictions
|
|
"upgrade-insecure-requests; " + // most modern sites enforce HTTPS as-is
|
|
"default-src 'none'; " +
|
|
"base-uri 'self'; " +
|
|
"object-src 'none'; " +
|
|
"frame-ancestors 'none'; " +
|
|
|
|
// scripts
|
|
"script-src 'self' 'unsafe-inline' " +
|
|
"https://cdnjs.cloudflare.com " +
|
|
"https://cdn.jsdelivr.net " +
|
|
"https://unpkg.com; " +
|
|
|
|
// assets
|
|
"style-src 'self' 'unsafe-inline' https:; " +
|
|
"font-src 'self' data: https:; " +
|
|
"img-src 'self' data: https:; " +
|
|
"media-src 'self' https:; " +
|
|
|
|
// APIs
|
|
"connect-src 'self' https:; " +
|
|
|
|
// outgoing iframes
|
|
"frame-src 'self' https:; "
|
|
|
|
const default_pp = "" +
|
|
"accelerometer=(), " +
|
|
"autoplay=(self), " +
|
|
"camera=(), " +
|
|
"display-capture=(), " +
|
|
"encrypted-media=(self), " +
|
|
"fullscreen=*, " + // YouTube embeds and alike
|
|
"geolocation=(), " +
|
|
"gyroscope=()," +
|
|
"hid=(), " +
|
|
"idle-detection=(), " +
|
|
"magnetometer=(), " +
|
|
"microphone=(), " +
|
|
"midi=(), " +
|
|
"payment=(), " +
|
|
"publickey-credentials-get=(self), " +
|
|
"screen-wake-lock=(self), " +
|
|
"serial=(), " +
|
|
"usb=(), " +
|
|
"xr-spatial-tracking=()"
|
|
|
|
type config struct {
|
|
listen_addr string
|
|
forgejo_url string
|
|
content_security_policy string
|
|
permissions_policy string
|
|
request_timeout time.Duration
|
|
}
|
|
|
|
func parse_config() config {
|
|
var cfg config
|
|
flag.StringVar(&cfg.listen_addr, "listen", ":8080", "listen address")
|
|
flag.StringVar(&cfg.forgejo_url, "forgejo-url", "", "Forgejo instance base URL, e.g. http://127.0.0.1:3000")
|
|
flag.StringVar(&cfg.content_security_policy, "content-security-policy", default_csp, "Content-Security-Policy for HTML responses")
|
|
flag.StringVar(&cfg.permissions_policy, "permissions-policy", default_pp, "Permissions-Policy for HTML responses")
|
|
flag.DurationVar(&cfg.request_timeout, "timeout", 15*time.Second, "upstream request timeout")
|
|
flag.Parse()
|
|
|
|
if cfg.forgejo_url == "" {
|
|
fmt.Fprintln(os.Stderr, "missing -forgejo-url")
|
|
os.Exit(2)
|
|
}
|
|
|
|
return cfg
|
|
}
|