From 9352935b883192df3ce46fcd539c5c056d20d1df Mon Sep 17 00:00:00 2001 From: nexxo Date: Sun, 26 Jul 2026 18:43:44 +0200 Subject: [PATCH] fix(nginx): the live hostnames were missing from the admin denylist MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The map listed only *.dev.clupilot.com, with the production names commented out under "add the real public hostnames here before launch". Launching without them removes the outer of the two layers that keep /admin off the public internet — the ADMIN_HOSTS check in the app would still answer 404, but the whole point of the pair is that neither is relied on alone. admin.clupilot.com stays out of the list on purpose: the list names the hosts that are PUBLIC, and the console is not one of them. Co-Authored-By: Claude Opus 5 --- ..env.swp | Bin 1024 -> 1024 bytes docker/nginx/default.conf | 7 ++++--- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/..env.swp b/..env.swp index 9f4258ed7174e33fbb2e58c4d463018de63b5822..7569c97585906b62d196b8955a364ea8a25a1955 100644 GIT binary patch delta 14 VcmZqRXyBM2!F;(}Vx#m^W&k3;1m*w$ delta 14 VcmZqRXyBM2!MssVV59U?W&j_11YZCE diff --git a/docker/nginx/default.conf b/docker/nginx/default.conf index e9112a3..05b3af2 100644 --- a/docker/nginx/default.conf +++ b/docker/nginx/default.conf @@ -13,9 +13,10 @@ map $host $admin_host_is_public { app.dev.clupilot.com 1; api.dev.clupilot.com 1; ws.dev.clupilot.com 1; - # Production (add the real public hostnames here before launch): - # www.clupilot.com 1; - # app.clupilot.com 1; + www.clupilot.com 1; + app.clupilot.com 1; + api.clupilot.com 1; + ws.clupilot.com 1; } server {