fix(deploy): add nginx healthcheck and ensure nginx listens on all interfaces

2026-09-25 11:08:53 -04:00
commit fd096a26ff
115 changed files with 22421 additions and 0 deletions
@@ -0,0 +1,34 @@
+/**
+ * Whether a dev-server API request came from the preview page itself.
+ *
+ * This is a cross-origin/CSRF control, NOT authorization. `Sec-Fetch-Site` is
+ * client-supplied and the preview URL needs no credentials, so a crafted request
+ * that sets the header still gets through. What it does stop: browser-driven
+ * cross-origin writes, and clients that send no fetch metadata at all.
+ *
+ * Browsers label the preview's own same-origin `fetch` calls
+ * `Sec-Fetch-Site: same-origin`. Hosts are compared rather than full origins
+ * because the request reaches Vite over plain HTTP behind the proxy, which
+ * forwards the original `Host`.
+ *
+ * @param {import('node:http').IncomingMessage} request
+ * @returns {boolean}
+ */
+export function isSameOriginRequest(request) {
+	const site = request.headers['sec-fetch-site'];
+	if (site) {
+		return site === 'same-origin';
+	}
+
+	// Pre-16.4 Safari omits fetch metadata but still sends `Origin` on POST.
+	const origin = request.headers.origin;
+	if (!origin) {
+		return false;
+	}
+
+	try {
+		return new URL(origin).host === request.headers.host;
+	} catch {
+		return false;
+	}
+}