[verified] Publish ReelBox source under GPLv3

website/deploy/nginx.conf

@@ -0,0 +1,57 @@
+user www-data;
+worker_processes 1;
+pid /run/reelbox-web/nginx.pid;
+error_log /var/log/reelbox/error.log warn;
+events { worker_connections 256; }
+http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+    client_body_temp_path /run/reelbox-web/client_temp;
+    proxy_temp_path /run/reelbox-web/proxy_temp;
+    fastcgi_temp_path /run/reelbox-web/fastcgi_temp;
+    uwsgi_temp_path /run/reelbox-web/uwsgi_temp;
+    scgi_temp_path /run/reelbox-web/scgi_temp;
+    server_tokens off;
+    sendfile on;
+    tcp_nopush on;
+    keepalive_timeout 30;
+    client_max_body_size 1k;
+    access_log off;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_session_cache shared:ReelboxTLS:1m;
+    ssl_session_timeout 1d;
+    ssl_session_tickets off;
+    server {
+        # Verify ownership/firewall rules on a new host before enabling 443.
+        listen 443 ssl http2;
+        listen [::]:443 ssl http2;
+        # Keep the legacy listener available for previously released clients.
+        listen 8443 ssl http2;
+        listen [::]:8443 ssl http2;
+        server_name reelbox.dartty.top;
+        ssl_certificate /etc/letsencrypt/live/reelbox.dartty.top/fullchain.pem;
+        ssl_certificate_key /etc/letsencrypt/live/reelbox.dartty.top/privkey.pem;
+        include /etc/reelbox/api-locations.conf;
+        root /var/www/reelbox/current;
+        index index.html;
+        include /etc/reelbox/security-headers.conf;
+        location / {
+            limit_except GET { deny all; }
+            try_files $uri $uri/ =404;
+        }
+        location /downloads/ {
+            limit_except GET { deny all; }
+            types {
+                application/vnd.android.package-archive apk;
+                application/zip zip;
+                text/plain txt;
+            }
+            autoindex off;
+            max_ranges 1;
+            try_files $uri =404;
+            include /etc/reelbox/security-headers.conf;
+            add_header Content-Disposition "attachment";
+        }
+        location ~ /\. { return 404; }
+    }
+}

website/deploy/reelbox-web.service

@@ -0,0 +1,30 @@
+[Unit]
+Description=Reelbox HTTPS download website
+After=network.target
+
+[Service]
+Type=simple
+RuntimeDirectory=reelbox-web
+RuntimeDirectoryMode=0755
+ExecStartPre=/usr/sbin/nginx -t -c /etc/reelbox/nginx.conf
+ExecStart=/usr/sbin/nginx -c /etc/reelbox/nginx.conf -g "daemon off;"
+ExecReload=/usr/sbin/nginx -t -c /etc/reelbox/nginx.conf
+ExecReload=/usr/sbin/nginx -c /etc/reelbox/nginx.conf -s reload
+KillSignal=SIGQUIT
+TimeoutStopSec=15
+Restart=on-failure
+RestartSec=3
+PrivateTmp=true
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+ReadWritePaths=/run/reelbox-web /var/log/reelbox
+MemoryMax=64M
+TasksMax=16
+LimitNOFILE=2048
+
+[Install]
+WantedBy=multi-user.target

website/deploy/renewal-hook.sh

@@ -0,0 +1,8 @@
+#!/bin/sh
+set -eu
+if [ "${RENEWED_LINEAGE:-}" = /etc/letsencrypt/live/reelbox.dartty.top ]; then
+    if systemctl is-active --quiet reelbox-web.service; then
+        /usr/sbin/nginx -t -c /etc/reelbox/nginx.conf
+        systemctl reload reelbox-web.service
+    fi
+fi

website/deploy/security-headers.conf

@@ -0,0 +1,6 @@
+add_header X-Content-Type-Options "nosniff" always;
+add_header Referrer-Policy "no-referrer" always;
+add_header X-Frame-Options "DENY" always;
+add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+add_header Content-Security-Policy "default-src 'none'; img-src 'self'; style-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; upgrade-insecure-requests" always;
+add_header Strict-Transport-Security "max-age=86400" always;