Skip to content

Test nginx docker ports#1926

Closed
alxndrsn wants to merge 21 commits into
getodk:masterfrom
alxndrsn:test-nginx-docker-ports
Closed

Test nginx docker ports#1926
alxndrsn wants to merge 21 commits into
getodk:masterfrom
alxndrsn:test-nginx-docker-ports

Conversation

@alxndrsn
Copy link
Copy Markdown
Contributor

Closes #

What has been done to verify that this works as intended?

Why is this the best possible solution? Were any other approaches considered?

How does this change affect users? Describe intentional changes to behavior and behavior that could have accidentally been affected by code changes. In other words, what are the regression risks?

Does this change require updates to documentation? If so, please file an issue here and include the link below.

Before submitting this PR, please make sure you have:

  • branched off and targeted the next branch OR only changed documentation/infrastructure (master is stable and used in production)
  • verified that any code or assets from external sources are properly credited in comments or that everything is internally sourced

alxndrsn and others added 21 commits April 18, 2026 08:08
Previously called `disallow-all`; rename to `backend-strict` to better reflect its usage rather than current implementation details.
Switch from Content-Security-Policy-Report-Only to Content-Security-Policy.
Switch from Content-Security-Policy-Report-Only to Content-Security-Policy.
It looks like the checkout code from the `test-images` job was copy/pasted elsewhere.

Simplifying this config should speed up git checkout in affected jobs.
Fixes: expected docker context is increased due to WF merge
The `DB_SSL` env var was made illegal in getodk#1647.

The check was then moved from runtime to build time in getodk#1671.

Checking at build-time allows for faster failure and clearer feedback to sysadmins who are upgrading, and previously depended on this env var.  However, the downside is that if container images are pre-built centrally, this check will be skipped.

With this commit, the check will move to container startup.  However, it will now be skipped if the container is started with a non-standard CMD/command/COMMAND.
Switch all headers from `Content-Security-Policy-Report-Only` to `Content-Security-Policy`.
Restrict TCP ports to the local machine.  This will prevent exposing these dev services on the local network or wider.
@alxndrsn alxndrsn closed this May 31, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants