Zareian
ba4ecff29e
- ops/nginx/: the two nginx sites as they now run on 249. Only ArvanCloud edges reach the app (direct hits on the IP get 403, so Arvan's DDoS/WAF can't be skipped); the frontend gets CSP (own sources only, the one inline script by hash), X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy, HSTS; API body limit 100M -> 20M plus HSTS. Checked from outside and in Chrome (all tabs and an island quiz, logged in): no CSP errors. - Demo accounts (users 11-15, 25) and TEST_LOGIN_PHONES removed from the server; the health warning for fixed-code logins now has a test and says how to test instead (an OTPCode made in the admin). - SMS daily cap on the server is 2000 (launch of ~600 users). - CLAUDE.md: never run tests with --parallel on macOS, always --noinput (both hang forever without an error). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
23 lines
1.1 KiB
Plaintext
23 lines
1.1 KiB
Plaintext
# روی ۲۴۹: /etc/nginx/snippets/zareian-arvan-only.conf — داخلِ server {}ِ دو سایتِ ما include میشود.
|
||
# فقط edgeهای ArvanCloud (و خودِ ماشین) به اپ میرسند؛ درخواستِ مستقیم به IPِ سرور ۴۰۳ میگیرد، پس سپرِ
|
||
# DDoS/WAFِ آروان دور زده نمیشود. فهرست از https://www.arvancloud.ir/fa/ips.txt (۲۰۲۶-۱۰-۱۳)؛ همان فهرستِ
|
||
# TRUSTED_PROXY_NETWORKS در config/settings.py. اگر آروان رنجِ تازه بگیرد و اینجا نباشد، کاربرانِ پشتِ آن edge
|
||
# ۴۰۳ میگیرند (در /var/log/nginx/access.log دیده میشود): هر دو فهرست را با هم تازه کنید.
|
||
allow 127.0.0.1;
|
||
allow ::1;
|
||
allow 185.143.232.0/22;
|
||
allow 188.229.116.16/30;
|
||
allow 94.101.182.0/27;
|
||
allow 2.144.3.128/28;
|
||
allow 37.32.16.0/27;
|
||
allow 37.32.17.0/27;
|
||
allow 37.32.18.0/27;
|
||
allow 37.32.19.0/27;
|
||
allow 185.215.232.0/22;
|
||
allow 178.131.120.48/28;
|
||
allow 94.101.183.0/28;
|
||
allow 78.157.36.112/28;
|
||
allow 95.38.61.80/28;
|
||
allow 193.24.119.0/29;
|
||
deny all;
|