Skip to content

fix: serve security headers from app nginx instead of ingress custom-headers #4186

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
devthejo wants to merge 3 commits into
base: master
Choose a base branch
from
Open

fix: serve security headers from app nginx instead of ingress custom-headers #4186

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
cd7624e
fix: serve security headers from app nginx instead of ingress custom-…
devthejo Jun 25, 2026
7416750
refactor: include security headers in every nginx location block
devthejo Jun 25, 2026
162a5f4
refactor: share a single nginx.conf across the three SPA images
devthejo Jun 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 4 additions & 25 deletions .kontinuous/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -171,14 +171,8 @@ frontend:
imagePackage: frontend
host: "{{ .Values.global.host }}"
containerPort: 8080
ingress:
customHeaders:
"Content-Security-Policy": "default-src 'none'; manifest-src 'self' https://*.gouv.fr; connect-src 'self' https://*.gouv.fr https://api.tally.so https://*.tally.so; font-src 'self' https://fonts.gstatic.com https://tally.so https://*.tally.so; img-src 'self' https://tally.so https://*.tally.so data:; script-src 'self' https://*.gouv.fr https://tally.so https://*.tally.so; frame-src 'self' https://*.gouv.fr https://tally.so https://*.tally.so; style-src 'self' 'unsafe-inline' https://*.gouv.fr https://tally.so https://*.tally.so"
"X-Frame-Options": "deny"
"X-Content-Type-Options": "nosniff"
"X-XSS-Protection": "0"
"Referrer-Policy": "strict-origin-when-cross-origin"
"Cache-Control": "no-store"
# Security headers are now set by the app's nginx (packages/frontend/nginx.conf)
# so they no longer depend on the ingress controller's custom-headers support.
resources:
requests:
cpu: 0.2
Expand All @@ -195,15 +189,7 @@ portail-admins:
~chart: app
imagePackage: portail-admins
host: "admin-{{ .Values.global.host }}"
ingress:
customHeaders:
"Content-Security-Policy": "default-src 'none'; manifest-src 'self' https://*.gouv.fr; connect-src 'self' https://*.gouv.fr; font-src 'self'; img-src 'self' data:; script-src 'self' https://*.gouv.fr; frame-src 'self' https://*.gouv.fr; style-src 'self' 'unsafe-inline' https://*.gouv.fr"
"X-Frame-Options": "deny"
"X-Robots-Tag": "noindex, nofollow, nosnippet, noarchive"
"X-Content-Type-Options": "nosniff"
"X-XSS-Protection": "0"
"Referrer-Policy": "strict-origin-when-cross-origin"
"Cache-Control": "no-store"
# Security headers are now set by the app's nginx (packages/portail-admins/nginx.conf).
containerPort: 8080
securityContext:
fsGroup: 101
Expand All @@ -214,14 +200,7 @@ portail-usagers:
~chart: app
imagePackage: portail-usagers
host: "mon-{{ .Values.global.host }}"
ingress:
customHeaders:
"Content-Security-Policy": "default-src 'none'; manifest-src 'self' https://*.gouv.fr; connect-src 'self' https://*.gouv.fr https://api.tally.so https://*.tally.so; font-src 'self' https://fonts.gstatic.com https://tally.so https://*.tally.so; img-src 'self' https://tally.so https://*.tally.so data:; script-src 'self' https://*.gouv.fr https://tally.so https://*.tally.so; frame-src 'self' https://*.gouv.fr https://tally.so https://*.tally.so; style-src 'self' 'unsafe-inline' https://*.gouv.fr https://tally.so https://*.tally.so"
"X-Frame-Options": "deny"
"X-Content-Type-Options": "nosniff"
"X-XSS-Protection": "0"
"Referrer-Policy": "strict-origin-when-cross-origin"
"Cache-Control": "no-store"
# Security headers are now set by the app's nginx (packages/portail-usagers/nginx.conf).
containerPort: 8080
securityContext:
fsGroup: 101
Expand Down
2 changes: 2 additions & 0 deletions packages/frontend/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,4 +63,6 @@ RUN corepack enable \

FROM ghcr.io/socialgouv/docker/nginx4spa:8.2.4

COPY ./packages/nginx.conf /etc/nginx/nginx.conf
COPY ./packages/frontend/security-headers.conf /etc/nginx/security-headers.conf
COPY --from=builder --chown=101:101 /app/packages/frontend/dist/domifa /usr/share/nginx/html
9 changes: 9 additions & 0 deletions packages/frontend/security-headers.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
# Security headers for the SPA. Included from nginx.conf at server level AND in
# every location block, because nginx drops inherited add_header directives in any
# location that defines its own — including it everywhere keeps a single source of truth.
add_header X-Frame-Options "deny" always;
add_header X-Content-Type-Options "nosniff" always;
Comment thread
devthejo marked this conversation as resolved.
add_header X-XSS-Protection "0" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Cache-Control "no-store" always;
add_header Content-Security-Policy "default-src 'none'; manifest-src 'self' https://*.gouv.fr; connect-src 'self' https://*.gouv.fr https://api.tally.so https://*.tally.so; font-src 'self' https://fonts.gstatic.com https://tally.so https://*.tally.so; img-src 'self' https://tally.so https://*.tally.so data:; script-src 'self' https://*.gouv.fr https://tally.so https://*.tally.so; frame-src 'self' https://*.gouv.fr https://tally.so https://*.tally.so; style-src 'self' 'unsafe-inline' https://*.gouv.fr https://tally.so https://*.tally.so" always;
77 changes: 77 additions & 0 deletions packages/nginx.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,77 @@
user nginx;
worker_processes auto; # it will be determinate automatically by the number of core

error_log /var/log/nginx/error.log warn;

events {
worker_connections 1024;
}


http {
server_tokens off;
absolute_redirect off;
access_log /var/log/nginx/access.log;
default_type application/octet-stream;
error_log /var/log/nginx/error.log;
include /etc/nginx/mime.types;
keepalive_timeout 3000;
Comment thread
devthejo marked this conversation as resolved.
sendfile on;

server {
listen 8080;
root /usr/share/nginx/html;
index index.html;
server_name_in_redirect on;

# Security headers served by the app itself, so they no longer depend on the
# ingress controller honouring nginx custom-headers annotations. nginx does not
# inherit add_header into a location that defines its own, so the headers are
# included in every location block below. This server-level include is only a
# fallback for requests matching no location (should not happen in practice).
include /etc/nginx/security-headers.conf;
Comment thread
devthejo marked this conversation as resolved.

Comment thread
devthejo marked this conversation as resolved.
charset utf-8;

gzip on;
gzip_disable "msie6";
gzip_vary on;
gzip_proxied any;
gzip_comp_level 6;
gzip_buffers 16 8k;
gzip_http_version 1.1;
gzip_min_length 256;
gzip_types text/css application/json application/javascript application/x-javascript text/javascript application/vnd.ms-fontobject application/x-font-ttf font/opentype image/svg+xml image/x-icon;

client_max_body_size 32m;
error_page 500 502 503 504 /50x.html;

location / {
include /etc/nginx/security-headers.conf;
# this always fallback on /index.html, never 404
try_files $uri $uri.html $uri/index.html $uri/ /index.html;
}

location /50x.html {
include /etc/nginx/security-headers.conf;
root /var/lib/nginx/html;
}

location /live {
include /etc/nginx/security-headers.conf;
default_type text/plain;
return 200 'OK';
}

include /etc/nginx/ready_response.conf;
location /ready {
include /etc/nginx/security-headers.conf;
default_type text/plain;
if ($ready_response = 'OK') {
return 200 $ready_response;
}
return 500 'Not Ready';
}

}
}
Comment thread
devthejo marked this conversation as resolved.
2 changes: 2 additions & 0 deletions packages/portail-admins/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,4 +52,6 @@ RUN corepack enable \

FROM ghcr.io/socialgouv/docker/nginx4spa:8.2.4

COPY ./packages/nginx.conf /etc/nginx/nginx.conf
COPY ./packages/portail-admins/security-headers.conf /etc/nginx/security-headers.conf
COPY --from=builder --chown=101:101 /app/packages/portail-admins/dist/domifa-portail-admins /usr/share/nginx/html
10 changes: 10 additions & 0 deletions packages/portail-admins/security-headers.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
# Security headers for the SPA. Included from nginx.conf at server level AND in
# every location block, because nginx drops inherited add_header directives in any
# location that defines its own — including it everywhere keeps a single source of truth.
add_header X-Frame-Options "deny" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "0" always;
add_header X-Robots-Tag "noindex, nofollow, nosnippet, noarchive" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Cache-Control "no-store" always;
add_header Content-Security-Policy "default-src 'none'; manifest-src 'self' https://*.gouv.fr; connect-src 'self' https://*.gouv.fr; font-src 'self'; img-src 'self' data:; script-src 'self' https://*.gouv.fr; frame-src 'self' https://*.gouv.fr; style-src 'self' 'unsafe-inline' https://*.gouv.fr" always;
2 changes: 2 additions & 0 deletions packages/portail-usagers/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,4 +50,6 @@ RUN corepack enable \

FROM ghcr.io/socialgouv/docker/nginx4spa:8.2.4

COPY ./packages/nginx.conf /etc/nginx/nginx.conf
COPY ./packages/portail-usagers/security-headers.conf /etc/nginx/security-headers.conf
COPY --from=builder --chown=101:101 /app/packages/portail-usagers/dist/domifa-portail-usagers /usr/share/nginx/html
9 changes: 9 additions & 0 deletions packages/portail-usagers/security-headers.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
# Security headers for the SPA. Included from nginx.conf at server level AND in
# every location block, because nginx drops inherited add_header directives in any
# location that defines its own — including it everywhere keeps a single source of truth.
add_header X-Frame-Options "deny" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "0" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Cache-Control "no-store" always;
add_header Content-Security-Policy "default-src 'none'; manifest-src 'self' https://*.gouv.fr; connect-src 'self' https://*.gouv.fr https://api.tally.so https://*.tally.so; font-src 'self' https://fonts.gstatic.com https://tally.so https://*.tally.so; img-src 'self' https://tally.so https://*.tally.so data:; script-src 'self' https://*.gouv.fr https://tally.so https://*.tally.so; frame-src 'self' https://*.gouv.fr https://tally.so https://*.tally.so; style-src 'self' 'unsafe-inline' https://*.gouv.fr https://tally.so https://*.tally.so" always;
Loading