Space: nginx refuses /internal/ and /metrics case-insensitively (#15)

OP OpenVibers committed 10 Oct 2026 · 28129a39ed · 1 file, +2 −1

* Space: nginx refuses /internal/ and /metrics case-insensitively

nginx config only. Express routes case-insensitively, so a case variant such as `/Internal/events` or `/METRICS` slipped past the case-sensitive `location /internal/ { return 404; }` and `location = /metrics { return 404; }` blocks and reached the app. Those paths were still guarded in the app (the Events signature, the loopback check on metrics). Both blocks are now `location ~* ^/internal(/|$)` and `location ~* ^/metrics(/|$)`. The independent security reviews of 2026-10-09/10 found this in several services; this applies it network-wide.

* nginx: openvibe.space serves the host's /.well-known/security.txt like every other site

Changes

ddiff --git a/deploy/nginx/openvibe.space.conf b/deploy/nginx/openvibe.space.conf
iindex d864a1d..22414fc 100644
---- a/deploy/nginx/openvibe.space.conf
++++ b/deploy/nginx/openvibe.space.conf
@@@ -45,6 +45,7 @@ server {
      listen [::]:443 ssl;
      http2 on;
      server_name openvibe.space;
++    include snippets/security-txt.conf;   # /.well-known/security.txt (the host's file)
  
      ssl_certificate     /etc/letsencrypt/live/openvibe.space/fullchain.pem;
      ssl_certificate_key /etc/letsencrypt/live/openvibe.space/privkey.pem;
@@@ -123,7 +124,7 @@ server {
  
      # ── Prometheus metrics: host-local scrapers only (http://127.0.0.1:4940/metrics). Node also
      #    refuses any request carrying X-Forwarded-For, which every location above sets. ──
--    location = /metrics { return 404; }
++    location ~* ^/metrics(/|$) { return 404; }
  
      # ── Everything else (server-rendered pages) ─────────────
      location / {