production hardening: future-date guard, per-day hour cap, totalHours in history, header cleanup

2026-02-19 04:48:43 +00:00
parent 47c35c1e3a
commit a0234cdd31
11 changed files with 222 additions and 51 deletions
@@ -12,11 +12,9 @@ server {
    listen [::]:80;
    server_name _;

-    # Security headers
-    add_header X-Frame-Options "SAMEORIGIN" always;
-    add_header X-Content-Type-Options "nosniff" always;
+    # Security headers (X-Frame-Options, HSTS, X-Content-Type-Options set by Caddy)
    add_header X-XSS-Protection "0" always;
-    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

    # Gzip compression
    gzip on;