Skip to content

Update default.conf.sample to deny dotfile access - #74

Open
nemchik wants to merge 2 commits into
masterfrom
deny-dotfile-access
Open

Update default.conf.sample to deny dotfile access#74
nemchik wants to merge 2 commits into
masterfrom
deny-dotfile-access

Conversation

@nemchik

@nemchik nemchik commented Feb 8, 2026

Copy link
Copy Markdown
Member

No description provided.

@LinuxServer-CI

LinuxServer-CI commented Feb 8, 2026

Copy link
Copy Markdown
Contributor

I am a bot, here are the test results for this PR:
https://ci-tests.linuxserver.io/lspipepr/freshrss/1.28.1-pkg-f6d42eb4-dev-90fd6619a2c5f3f30944c5215539d0ba81930904-pr-74/index.html
https://ci-tests.linuxserver.io/lspipepr/freshrss/1.28.1-pkg-f6d42eb4-dev-90fd6619a2c5f3f30944c5215539d0ba81930904-pr-74/shellcheck-result.xml

Tag Passed
amd64-1.28.1-pkg-f6d42eb4-dev-90fd6619a2c5f3f30944c5215539d0ba81930904-pr-74 ✅
arm64v8-1.28.1-pkg-f6d42eb4-dev-90fd6619a2c5f3f30944c5215539d0ba81930904-pr-74 ✅

@LinuxServer-CI

LinuxServer-CI commented Mar 1, 2026

Copy link
Copy Markdown
Contributor

I am a bot, here are the test results for this PR:
https://ci-tests.linuxserver.io/lspipepr/freshrss/1.28.1-pkg-11c22145-dev-f5ebe1a98630f79e49880a0977213efd96f87efa-pr-74/index.html
https://ci-tests.linuxserver.io/lspipepr/freshrss/1.28.1-pkg-11c22145-dev-f5ebe1a98630f79e49880a0977213efd96f87efa-pr-74/shellcheck-result.xml

Tag Passed
amd64-1.28.1-pkg-11c22145-dev-f5ebe1a98630f79e49880a0977213efd96f87efa-pr-74 ✅
arm64v8-1.28.1-pkg-11c22145-dev-f5ebe1a98630f79e49880a0977213efd96f87efa-pr-74 ✅

@LinuxServer-CI

LinuxServer-CI commented Mar 28, 2026

Copy link
Copy Markdown
Contributor

I am a bot, here are the test results for this PR:
https://ci-tests.linuxserver.io/lspipepr/freshrss/1.28.1-pkg-6b31f207-dev-266bc63c79ec0bc79687a74613687317a9f74959-pr-74/index.html
https://ci-tests.linuxserver.io/lspipepr/freshrss/1.28.1-pkg-6b31f207-dev-266bc63c79ec0bc79687a74613687317a9f74959-pr-74/shellcheck-result.xml

Tag Passed
amd64-1.28.1-pkg-6b31f207-dev-266bc63c79ec0bc79687a74613687317a9f74959-pr-74 ✅
arm64v8-1.28.1-pkg-6b31f207-dev-266bc63c79ec0bc79687a74613687317a9f74959-pr-74 ✅

@LinuxServer-CI

LinuxServer-CI commented Apr 24, 2026

Copy link
Copy Markdown
Contributor

I am a bot, here are the test results for this PR:
https://ci-tests.linuxserver.io/lspipepr/freshrss/1.28.1-pkg-96f4a66a-dev-04ecdcd6fdb863e33c5d880d97276ac6f7fe14cb-pr-74/index.html
https://ci-tests.linuxserver.io/lspipepr/freshrss/1.28.1-pkg-96f4a66a-dev-04ecdcd6fdb863e33c5d880d97276ac6f7fe14cb-pr-74/shellcheck-result.xml

Tag Passed
amd64-1.28.1-pkg-96f4a66a-dev-04ecdcd6fdb863e33c5d880d97276ac6f7fe14cb-pr-74 ✅
arm64v8-1.28.1-pkg-96f4a66a-dev-04ecdcd6fdb863e33c5d880d97276ac6f7fe14cb-pr-74 ✅

@nemchik
Move dotfile denial up
81cd3f7 
Signed-off-by: Eric Nemchik <[email protected]>
Copilot AI review requested due to automatic review settings May 5, 2026 21:42
@LinuxServer-CI LinuxServer-CI moved this from PRs to PRs Ready For Team Review in Issue & PR Tracker May 5, 2026
Copilot AI reviewed May 5, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the FreshRSS nginx sample config to block access to dotfiles while explicitly allowing /.well-known, and it also refreshes the image changelog metadata used for generated docs.

Changes:

  • Add nginx rules to allow /.well-known while returning 404 for other dotfile paths.
  • Reformat the PHP file existence guard in the sample nginx config.
  • Add a changelog entry in readme-vars.yml describing the dotfile-access update.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File Description
root/defaults/nginx/site-confs/default.conf.sample Updates the default nginx vhost with dotfile blocking, a /.well-known exception, and new QUIC listen directives.
readme-vars.yml Adds a changelog note instructing existing users to update their nginx site config.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread root/defaults/nginx/site-confs/default.conf.sample
Comment on lines +8 to +9
listen 443 quic reuseport default_server;
listen [::]:443 quic reuseport default_server;
Comment thread readme-vars.yml
"freshrss:latest" <- Base Images
# changelog
changelogs:
- {date: "08.02.26:", desc: "Existing users should update: site-confs/default.conf - Deny access to all dotfiles."}
@LinuxServer-CI

LinuxServer-CI commented May 5, 2026

Copy link
Copy Markdown
Contributor

I am a bot, here are the test results for this PR:
https://ci-tests.linuxserver.io/lspipepr/freshrss/1.28.1-pkg-868608f6-dev-a67b37a9df5fe7583a571e81e9fba6e4f5ea810d-pr-74/index.html
https://ci-tests.linuxserver.io/lspipepr/freshrss/1.28.1-pkg-868608f6-dev-a67b37a9df5fe7583a571e81e9fba6e4f5ea810d-pr-74/shellcheck-result.xml

Tag Passed
amd64-1.28.1-pkg-868608f6-dev-a67b37a9df5fe7583a571e81e9fba6e4f5ea810d-pr-74 ✅
arm64v8-1.28.1-pkg-868608f6-dev-a67b37a9df5fe7583a571e81e9fba6e4f5ea810d-pr-74 ✅

@LinuxServer-CI LinuxServer-CI moved this from PRs Ready For Team Review to PRs in Issue & PR Tracker May 5, 2026
@LinuxServer-CI

LinuxServer-CI commented Jun 4, 2026

Copy link
Copy Markdown
Contributor

I am a bot, here are the test results for this PR for commit b04b35d :
https://ci-tests.linuxserver.io/lspipepr/freshrss/1.29.1-pkg-37010ecb-dev-b04b35d46ff4ed61b839bd1c19e1c23e01601a48-pr-74/index.html
https://ci-tests.linuxserver.io/lspipepr/freshrss/1.29.1-pkg-37010ecb-dev-b04b35d46ff4ed61b839bd1c19e1c23e01601a48-pr-74/shellcheck-result.xml

Tag Passed
amd64-1.29.1-pkg-37010ecb-dev-b04b35d46ff4ed61b839bd1c19e1c23e01601a48-pr-74 ✅
arm64v8-1.29.1-pkg-37010ecb-dev-b04b35d46ff4ed61b839bd1c19e1c23e01601a48-pr-74 ✅

@LinuxServer-CI

LinuxServer-CI commented Jul 1, 2026

Copy link
Copy Markdown
Contributor

I am a bot, here are the test results for this PR for commit b1ab7b9 :
https://ci-tests.linuxserver.io/lspipepr/freshrss/1.29.1-pkg-35232207-dev-b1ab7b95707e5a64f0db1ccc0c538a4ab0788ba1-pr-74/index.html
https://ci-tests.linuxserver.io/lspipepr/freshrss/1.29.1-pkg-35232207-dev-b1ab7b95707e5a64f0db1ccc0c538a4ab0788ba1-pr-74/shellcheck-result.xml

Tag Passed
amd64-1.29.1-pkg-35232207-dev-b1ab7b95707e5a64f0db1ccc0c538a4ab0788ba1-pr-74 ✅
arm64v8-1.29.1-pkg-35232207-dev-b1ab7b95707e5a64f0db1ccc0c538a4ab0788ba1-pr-74 ✅

@LinuxServer-CI

LinuxServer-CI commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

I am a bot, here are the test results for this PR for commit cb9d345 :
https://ci-tests.linuxserver.io/lspipepr/freshrss/1.29.1-pkg-efe0ad73-dev-cb9d3458160638a38a4d0ad14b0be19aa35a753f-pr-74/index.html
https://ci-tests.linuxserver.io/lspipepr/freshrss/1.29.1-pkg-efe0ad73-dev-cb9d3458160638a38a4d0ad14b0be19aa35a753f-pr-74/shellcheck-result.xml

Tag Passed
amd64-1.29.1-pkg-efe0ad73-dev-cb9d3458160638a38a4d0ad14b0be19aa35a753f-pr-74 ✅
arm64v8-1.29.1-pkg-efe0ad73-dev-cb9d3458160638a38a4d0ad14b0be19aa35a753f-pr-74 ✅

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

Issue & PR Tracker
Status: PRs

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@nemchik @LinuxServer-CI