From 13a66c8720edae892c2d6eabdcc33341e028c245 Mon Sep 17 00:00:00 2001 From: Eric Nemchik Date: Sun, 8 Feb 2026 09:39:49 -0600 Subject: [PATCH] Update default.conf.sample to deny dotfile access Signed-off-by: Eric Nemchik --- readme-vars.yml | 1 + .../nginx/site-confs/default.conf.sample | 16 +++++++++++++--- 2 files changed, 14 insertions(+), 3 deletions(-) diff --git a/readme-vars.yml b/readme-vars.yml index 3472829..cf32d1f 100755 --- a/readme-vars.yml +++ b/readme-vars.yml @@ -85,6 +85,7 @@ init_diagram: | "dokuwiki:latest" <- Base Images # changelog changelogs: + - {date: "08.02.26:", desc: "Existing users should update: site-confs/default.conf - Deny access to all dotfiles."} - {date: "05.07.25:", desc: "Rebase to Alpine 3.22."} - {date: "10.05.25:", desc: "Rebase to Alpine 3.21."} - {date: "31.05.24:", desc: "Rebase to Alpine 3.20. Existing users should update their nginx confs to avoid http2 deprecation warnings."} diff --git a/root/defaults/nginx/site-confs/default.conf.sample b/root/defaults/nginx/site-confs/default.conf.sample index 162dde0..c9b3172 100644 --- a/root/defaults/nginx/site-confs/default.conf.sample +++ b/root/defaults/nginx/site-confs/default.conf.sample @@ -1,10 +1,12 @@ -## Version 2024/07/16 - Changelog: https://github.com/linuxserver/docker-dokuwiki/commits/master/root/defaults/nginx/site-confs/default.conf.sample +## Version 2026/02/08 - Changelog: https://github.com/linuxserver/docker-dokuwiki/commits/master/root/defaults/nginx/site-confs/default.conf.sample server { listen 80 default_server; listen [::]:80 default_server; listen 443 ssl default_server; listen [::]:443 ssl default_server; + listen 443 quic reuseport default_server; + listen [::]:443 quic reuseport default_server; server_name _; @@ -50,8 +52,16 @@ server { include /etc/nginx/fastcgi_params; } - # deny access to .htaccess/.htpasswd files - location ~ /\.ht { + # deny access to all dotfiles + location ~ /\. { deny all; + log_not_found off; + access_log off; + return 404; + } + + # Allow access to the ".well-known" directory + location ^~ /.well-known { + allow all; } }