From 243d4eefcd9eee17900a804267a459ab43e3311b Mon Sep 17 00:00:00 2001
From: ixgadmin <admin@ixg.local>
Date: Fri, 25 Sep 2026 12:37:40 +0000
Subject: [PATCH] Run with DEBUG off and add HSTS and CSP headers

DEBUG was on in production, so an error rendered a full traceback and the
DEBUG-only media route served /media/ixg-documents/... publicly, bypassing
the document permission checks. Set DJANGO_DEBUG=False in the env files
(untracked) and add friendly 500/404/403 templates.

With DEBUG off Django no longer serves /static/, so nginx does: the static
root moves to /var/www/ixg-platform-static (mounted into the app container)
because /root is not traversable by www-data.

HSTS (max-age 1y, includeSubDomains) is added to every HTTPS host, and a
pragmatic CSP to the app/ops/portal locations. 'unsafe-inline' is required
by the inline scripts/styles; self-hosting the CDN assets and nonces is a
follow-up.
---
 docker-compose.yml |  2 +-
 templates/403.html | 22 ++++++++++++++++++++++
 templates/404.html | 22 ++++++++++++++++++++++
 templates/500.html | 23 +++++++++++++++++++++++
 4 files changed, 68 insertions(+), 1 deletion(-)
 create mode 100644 templates/403.html
 create mode 100644 templates/404.html
 create mode 100644 templates/500.html

diff --git a/docker-compose.yml b/docker-compose.yml
index da7cb23..0a3fa0a 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -46,7 +46,7 @@ services:
         condition: service_healthy
     volumes:
       - .:/app
-      - ./staticfiles:/app/staticfiles
+      - /var/www/ixg-platform-static:/app/staticfiles
       - ./media:/app/media
       - ./documents:/data/ixg-documents
     env_file:
diff --git a/templates/403.html b/templates/403.html
new file mode 100644
index 0000000..2399dd3
--- /dev/null
+++ b/templates/403.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html lang="en-gb">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Not allowed</title>
+<style>
+body { margin: 0; font-family: system-ui, -apple-system, "Segoe UI", sans-serif; background: #f0fdf4; color: #1f2937; }
+.wrap { max-width: 34rem; margin: 12vh auto; padding: 0 1.5rem; text-align: center; }
+h1 { font-size: 1.5rem; color: #065f46; margin: 0 0 .75rem; }
+p { line-height: 1.5; color: #475569; }
+a { color: #065f46; }
+</style>
+</head>
+<body>
+<div class="wrap">
+  <h1>Not allowed</h1>
+  <p>Your account does not have access to that page.</p>
+  <p><a href="/">Return to the start</a></p>
+</div>
+</body>
+</html>
diff --git a/templates/404.html b/templates/404.html
new file mode 100644
index 0000000..45e0914
--- /dev/null
+++ b/templates/404.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html lang="en-gb">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Page not found</title>
+<style>
+body { margin: 0; font-family: system-ui, -apple-system, "Segoe UI", sans-serif; background: #f0fdf4; color: #1f2937; }
+.wrap { max-width: 34rem; margin: 12vh auto; padding: 0 1.5rem; text-align: center; }
+h1 { font-size: 1.5rem; color: #065f46; margin: 0 0 .75rem; }
+p { line-height: 1.5; color: #475569; }
+a { color: #065f46; }
+</style>
+</head>
+<body>
+<div class="wrap">
+  <h1>Page not found</h1>
+  <p>The page you asked for is not here. Check the address, or return to the start.</p>
+  <p><a href="/">Return to the start</a></p>
+</div>
+</body>
+</html>
diff --git a/templates/500.html b/templates/500.html
new file mode 100644
index 0000000..4e0d6c5
--- /dev/null
+++ b/templates/500.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html lang="en-gb">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Something went wrong</title>
+<style>
+body { margin: 0; font-family: system-ui, -apple-system, "Segoe UI", sans-serif; background: #f0fdf4; color: #1f2937; }
+.wrap { max-width: 34rem; margin: 12vh auto; padding: 0 1.5rem; text-align: center; }
+h1 { font-size: 1.5rem; color: #065f46; margin: 0 0 .75rem; }
+p { line-height: 1.5; color: #475569; }
+a { color: #065f46; }
+</style>
+</head>
+<body>
+<div class="wrap">
+  <h1>Something went wrong</h1>
+  <p>The platform hit an unexpected error and could not finish that request.
+     It has been recorded. Please try again in a moment.</p>
+  <p><a href="/">Return to the start</a></p>
+</div>
+</body>
+</html>