fix Caddyfile config, update PHP dependencies, vendor in frontend dep…

…endencies and define a Content Security Policy
BcnBitcoinOnly · Jul 30, 2024 · 42fb79b · 42fb79b
1 parent 4ed83ae
commit 42fb79b
Show file tree

Hide file tree

Showing 8 changed files with 90 additions and 72 deletions.
diff --git a/composer.json b/composer.json
@@ -15,7 +15,7 @@
         "uma/dic": "^4.0"
     },
     "require-dev": {
-        "friendsofphp/php-cs-fixer": "^3.59",
+        "friendsofphp/php-cs-fixer": "^3.60",
         "phpunit/phpunit": "^11.2",
         "roave/security-advisories": "dev-latest"
     },

diff --git a/composer.lock b/composer.lock
diff --git a/docs/caddy/Caddyfile-dev b/docs/caddy/Caddyfile-dev
@@ -1,5 +1,6 @@
 :80 {
 	root * /var/www/signet-faucet/web
+	file_server
 	encode zstd gzip
 	php_fastcgi php-fpm:9000
 }
diff --git a/docs/caddy/Caddyfile-prod b/docs/caddy/Caddyfile-prod
@@ -1,5 +1,6 @@
 faucet.example.com {
 	root * /var/www/signet-faucet/current/web
+	file_server
 	encode zstd gzip
 	php_fastcgi unix//run/php/php-fpm.sock {
 		resolve_root_symlink

diff --git a/src/DI/Faucet.php b/src/DI/Faucet.php
@@ -36,6 +36,7 @@ public function provide(Container $c): void
             $twig->getEnvironment()->addGlobal('faucet_max_btc', (string) $settings->maxOneTimeBtc);
             $twig->getEnvironment()->addGlobal('use_captcha', $settings->useCaptcha);
             $twig->getEnvironment()->addGlobal('use_password', null !== $settings->passwordBcryptHash);
+            $twig->getEnvironment()->addGlobal('random_nonce', base64_encode(random_bytes(12)));
 
             return $twig;
         });

diff --git a/views/index.html.twig b/views/index.html.twig
@@ -3,9 +3,11 @@
 <head>
     <meta charset="utf-8">
     <meta name="viewport" content="width=device-width, initial-scale=1">
+    <meta name="htmx-config" content='{"inlineStyleNonce":"{{ random_nonce }}"}'>
+    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; style-src 'self' 'nonce-{{ random_nonce }}'; object-src 'none';">
     <title>{{ faucet_name }}</title>
-    <script src="https://unpkg.com/htmx.org@2.0.0" integrity="sha384-wS5l5IKJBvK6sPTKa2WZ1js3d947pvWXbPJ1OmWfEuxLgeHcEbjUUA5i9V5ZkpCw" crossorigin="anonymous"></script>
-    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bulma@1.0.1/css/bulma.min.css" integrity="sha384-u1DpPo/VC1cCewPdLA1ujElPdm1c/ZVa5MNAV6930PlrYYXhoKH/+hui6tE7szxu" crossorigin="anonymous">
+    <script src="/js/htmx-2.0.1.min.js"></script>
+    <link rel="stylesheet" href="/css/bulma-1.0.2.min.css">
     <link rel="stylesheet" href="/css/main.css">
 </head>
 

diff --git a/web/css/bulma-1.0.2.min.css b/web/css/bulma-1.0.2.min.css
diff --git a/web/js/htmx-2.0.1.min.js b/web/js/htmx-2.0.1.min.js