Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CMD/ENTRYPOINT and WORKDIR is not set #3

Open
moqmar opened this issue Apr 18, 2020 · 5 comments
Open

CMD/ENTRYPOINT and WORKDIR is not set #3

moqmar opened this issue Apr 18, 2020 · 5 comments

Comments

@moqmar
Copy link

moqmar commented Apr 18, 2020

It would make it much easier to use hastatic without a custom Dockerfile if the following lines were added:

WORKDIR "/var/www"
ENTRYPOINT ["/usr/bin/hastatic"]
moqmar added a commit to moqmar-docker/hastatic that referenced this issue Apr 28, 2020
@moqmar
Copy link
Author

moqmar commented Apr 28, 2020

I decided to also set the port to 80, as it's the default in basically all reverse proxies and also makes sense when directly exposing the container.

@beantaxi
Copy link

beantaxi commented Feb 1, 2021

@moqmar I actually came to Issues to suggest adding exactly these features. Do you have a fork, or some way of using them? If not, I can just 'borrow' your solution from your commit. Thanks!

@moqmar
Copy link
Author

moqmar commented Feb 2, 2021

No, Haskell isn't something I know or have wanted to learn, so I actually ended up rewriting something similar in Go. It doesn't support HTTPS (as using Docker implies a reverse proxy in most cases), but is quite a bit more configurable than hastatic, and even a bit faster.

@beantaxi
Copy link

@moqmar I just fired up web/momar! It works great, but I do have an issue, and I can't raise issues without joining codeberg, which I'd rather not do ...

I was hoping that web/momar would allow disabling CORS, so I can host any type of content, eg font files, without a CORS warning. From a quick look at the code those headers appear hardcoded. I like your choice of ignoring HTTPS, which is unnecessary for simple local testing, and I was wondering if you might feel the same about disabling security headers, at least optionally.

Thanks!

@moqmar
Copy link
Author

moqmar commented Feb 23, 2021

I agree that that'd be useful & copied your request to the Codeberg repo, together with a suggestion on security headers in general and can probably look into that tomorrow.

TL;DR: only the Referrer-Policy: strict-origin-when-cross-origin header will stay, and there will be an ENABLE_CORS variable that allows hosting web fonts and accessing static content via JavaScript, which will be disabled by default.

Let's not spam this issue here any further, just check back on Thursday, I'll probably have an update ready then. For further questions you can also use my email address in my profile here on GitHub.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants