Harden the Visual X# website origin boundary with explicit unknown-host rejection on HTTP and TLS, canonicalize duplicate www, docs, and spec origins while preserving paths and queries, restore complete cleartext redirects and ACME handling, and remove the retired Marked dependency and stale notices after the ViGet migration.

1 files changed, 36 insertions, 2 deletions

diff --git a/ops/nginx/xsharp.conf b/ops/nginx/xsharp.conf
index 78e70b9..20d1421 100644
--- a/ops/nginx/xsharp.conf
+++ b/ops/nginx/xsharp.conf
@@ -2,9 +2,43 @@
 # SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1
 
 server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    server_name _;
+    server_tokens off;
+
+    return 444;
+}
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name xsharp-lang.xyz www.xsharp-lang.xyz docs.xsharp-lang.xyz spec.xsharp-lang.xyz;
+    server_tokens off;
+
+    location ^~ /.well-known/acme-challenge/ {
+        root /var/lib/letsencrypt;
+        default_type text/plain;
+    }
+
+    location / {
+        return 308 https://xsharp-lang.xyz$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl default_server;
+    listen [::]:443 ssl default_server;
+    server_name _;
+    server_tokens off;
+
+    ssl_reject_handshake on;
+}
+
+server {
     listen 443 ssl;
     listen [::]:443 ssl;
-    server_name xsharp-lang.xyz docs.xsharp-lang.xyz spec.xsharp-lang.xyz;
+    server_name xsharp-lang.xyz;
 
     root /srv/xsharp/website/current/frontend;
     index index.html;
@@ -74,7 +108,7 @@ server {
 server {
     listen 443 ssl;
     listen [::]:443 ssl;
-    server_name www.xsharp-lang.xyz;
+    server_name www.xsharp-lang.xyz docs.xsharp-lang.xyz spec.xsharp-lang.xyz;
     server_tokens off;
 
     ssl_certificate /etc/letsencrypt/live/xsharp-lang.xyz/fullchain.pem;