ixgadmin/ixg_platform
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Run with DEBUG off and add HSTS and CSP headers

Browse source 
DEBUG was on in production, so an error rendered a full traceback and the
DEBUG-only media route served /media/ixg-documents/... publicly, bypassing
the document permission checks. Set DJANGO_DEBUG=False in the env files
(untracked) and add friendly 500/404/403 templates.

With DEBUG off Django no longer serves /static/, so nginx does: the static
root moves to /var/www/ixg-platform-static (mounted into the app container)
because /root is not traversable by www-data.

HSTS (max-age 1y, includeSubDomains) is added to every HTTPS host, and a
pragmatic CSP to the app/ops/portal locations. 'unsafe-inline' is required
by the inline scripts/styles; self-hosting the CDN assets and nonces is a
follow-up.
This commit is contained in:
ixgadmin 2026-09-25 12:37:40 +00:00
parent 8c8e7908fd
commit 243d4eefcd
4 changed files with 68 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
docker-compose.yml
View file

@ -46,7 +46,7 @@ services:
condition: service_healthy condition: service_healthy
volumes: volumes:
- .:/app - .:/app
- ./staticfiles:/app/staticfiles - /var/www/ixg-platform-static:/app/staticfiles
- ./media:/app/media - ./media:/app/media
- ./documents:/data/ixg-documents - ./documents:/data/ixg-documents
env_file: env_file:

22
templates/403.html Normal file
View file

@ -0,0 +1,22 @@
<!DOCTYPE html>
<html lang="en-gb">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Not allowed</title>
<style>
body { margin: 0; font-family: system-ui, -apple-system, "Segoe UI", sans-serif; background: #f0fdf4; color: #1f2937; }
.wrap { max-width: 34rem; margin: 12vh auto; padding: 0 1.5rem; text-align: center; }
h1 { font-size: 1.5rem; color: #065f46; margin: 0 0 .75rem; }
p { line-height: 1.5; color: #475569; }
a { color: #065f46; }
</style>
</head>
<body>
<div class="wrap">
<h1>Not allowed</h1>
<p>Your account does not have access to that page.</p>
<p><a href="/">Return to the start</a></p>
</div>
</body>
</html>

22
templates/404.html Normal file
View file

@ -0,0 +1,22 @@
<!DOCTYPE html>
<html lang="en-gb">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Page not found</title>
<style>
body { margin: 0; font-family: system-ui, -apple-system, "Segoe UI", sans-serif; background: #f0fdf4; color: #1f2937; }
.wrap { max-width: 34rem; margin: 12vh auto; padding: 0 1.5rem; text-align: center; }
h1 { font-size: 1.5rem; color: #065f46; margin: 0 0 .75rem; }
p { line-height: 1.5; color: #475569; }
a { color: #065f46; }
</style>
</head>
<body>
<div class="wrap">
<h1>Page not found</h1>
<p>The page you asked for is not here. Check the address, or return to the start.</p>
<p><a href="/">Return to the start</a></p>
</div>
</body>
</html>

23
templates/500.html Normal file
View file

@ -0,0 +1,23 @@
<!DOCTYPE html>
<html lang="en-gb">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Something went wrong</title>
<style>
body { margin: 0; font-family: system-ui, -apple-system, "Segoe UI", sans-serif; background: #f0fdf4; color: #1f2937; }
.wrap { max-width: 34rem; margin: 12vh auto; padding: 0 1.5rem; text-align: center; }
h1 { font-size: 1.5rem; color: #065f46; margin: 0 0 .75rem; }
p { line-height: 1.5; color: #475569; }
a { color: #065f46; }
</style>
</head>
<body>
<div class="wrap">
<h1>Something went wrong</h1>
<p>The platform hit an unexpected error and could not finish that request.
It has been recorded. Please try again in a moment.</p>
<p><a href="/">Return to the start</a></p>
</div>
</body>
</html>