Add secure Node image webhook service

deploy/nginx/Dockerfile

@@ -0,0 +1,9 @@
+FROM nginx:1.29.5-alpine@sha256:1eff5a5f3fcf8431a0abb7eddf5471fec24e5e1905a2581aeacdb07a4479b92b
+
+COPY templates/default.conf.template /etc/image/default.conf.template
+COPY entrypoint.sh /usr/local/bin/image-web-entrypoint
+RUN chmod 0555 /usr/local/bin/image-web-entrypoint
+
+USER nginx
+EXPOSE 8080
+ENTRYPOINT ["/usr/local/bin/image-web-entrypoint"]

deploy/nginx/entrypoint.sh

@@ -0,0 +1,13 @@
+#!/bin/sh
+set -eu
+
+if [ -z "${CADDY_SOURCE_CIDR:-}" ]; then
+    echo "CADDY_SOURCE_CIDR is required" >&2
+    exit 1
+fi
+
+envsubst '${CADDY_SOURCE_CIDR}' \
+    < /etc/image/default.conf.template \
+    > /tmp/nginx.conf
+
+exec nginx -c /tmp/nginx.conf -g 'daemon off;'

deploy/nginx/templates/default.conf.template

@@ -0,0 +1,91 @@
+worker_processes auto;
+pid /tmp/nginx.pid;
+error_log /dev/stderr notice;
+
+events {
+    worker_connections 256;
+}
+
+http {
+  include /etc/nginx/mime.types;
+  access_log /dev/stdout combined;
+  client_body_temp_path /tmp/client_body;
+  proxy_temp_path /tmp/proxy;
+  fastcgi_temp_path /tmp/fastcgi;
+  uwsgi_temp_path /tmp/uwsgi;
+  scgi_temp_path /tmp/scgi;
+
+  server {
+      listen 8080;
+      server_name _;
+      server_tokens off;
+      root /srv/image;
+      disable_symlinks on;
+
+    allow 127.0.0.1;
+    allow ::1;
+    allow ${CADDY_SOURCE_CIDR};
+    deny all;
+
+    location = /healthz {
+        proxy_pass http://image-hook:8081/healthz;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    }
+
+    location = /v1/status {
+        proxy_pass http://image-hook:8081/v1/status;
+        proxy_set_header Host $host;
+        add_header Access-Control-Allow-Origin "*" always;
+    }
+
+    location = /v1/inventory {
+        proxy_pass http://image-hook:8081/v1/inventory;
+        proxy_set_header Host $host;
+        proxy_buffering off;
+        add_header Access-Control-Allow-Origin "*" always;
+    }
+
+    location = /v1/hooks/gitea {
+        limit_except POST { deny all; }
+        client_max_body_size 1m;
+        proxy_pass http://image-hook:8081/v1/hooks/gitea;
+        proxy_set_header Host $host;
+        proxy_set_header X-Gitea-Signature $http_x_gitea_signature;
+        proxy_set_header X-Gitea-Event $http_x_gitea_event;
+        proxy_set_header X-Gitea-Delivery $http_x_gitea_delivery;
+        proxy_request_buffering on;
+    }
+
+    location ^~ /v1/admin/ { return 404; }
+    location = /image { return 404; }
+    location = /image/ { return 404; }
+    location ^~ /image/ { rewrite ^/image/(.*)$ /$1 last; }
+
+    location ^~ /game/ {
+        try_files $uri =404;
+        add_header Access-Control-Allow-Origin "*" always;
+        add_header X-Content-Type-Options nosniff always;
+    }
+
+    location ^~ /icons/ {
+        try_files $uri =404;
+        add_header Access-Control-Allow-Origin "*" always;
+        add_header X-Content-Type-Options nosniff always;
+    }
+
+    location = /hook/list.json {
+        try_files $uri =404;
+        add_header Access-Control-Allow-Origin "*" always;
+    }
+
+    location = /hook/inventory.v2.json {
+        try_files $uri =404;
+        add_header Access-Control-Allow-Origin "*" always;
+    }
+
+    location ~ (^|/)\. { return 404; }
+    location ~ \.php$ { return 404; }
+      location / { return 404; }
+  }
+}