|
`curl https://jayrup.me/public_key` is the documented way to get this key
onto a VPS, so both the file and the config serving it need to be exact.
Key file: drop the trailing space, one trailing newline. A key with no
trailing newline makes `curl ... >> ~/.ssh/authorized_keys` glue itself onto
the previous line and silently break every later key in the file.
nginx:
- `/assets/public_key` ignored $final_suffix, so curl got 404 while browsers
got 200. Route both through the suffix-aware try_files.
- add_header does not merge across levels: the asset, PDF and .txt locations
each declared one, so they inherited none of the security headers. The
asset location now repeats them; the PDF and .txt locations no longer
declare any (default_type / mime.types + charset do the job), so they
inherit again.
- `add_header Content-Type application/pdf` appended a second Content-Type
instead of setting it. Use default_type.
- `expires 30d` plus an explicit Cache-Control emitted two Cache-Control
headers. Use one explicit header.
- add `charset utf-8` so text/plain (what curl gets) is not served
charset-less while the content contains non-ASCII.
deploy: ship nginx.conf alongside public/. It is bind-mounted into the
container, so it never travelled with the rsync'd tree — the live config was
from May and predated the hardening committed in 0ee667a. Test with
`nginx -t` before reloading and restore the previous config on failure.
|
