Retire registry authentication from xsharp-lang.xyz. Restrict the language host from serving the shared static /repo tree, remove the legacy api.xsharp-lang.xyz Nginx endpoint and backend host allowance, and identify the same-origin API as ViGet. Document that login, registration, and registry APIs belong exclusively to viget.progmasoft.com while preserving the dedicated legacy ViGet redirect.

1 files changed, 10 insertions, 29 deletions

diff --git a/ops/nginx/xsharp.conf b/ops/nginx/xsharp.conf
index 4216c68..7881759 100644
--- a/ops/nginx/xsharp.conf
+++ b/ops/nginx/xsharp.conf
@@ -21,6 +21,16 @@ server {
     add_header X-Content-Type-Options "nosniff" always;
     add_header X-Frame-Options "DENY" always;
 
+    # Registry pages are built in the same static artifact but belong only to
+    # viget.progmasoft.com. The language host must never expose auth surfaces.
+    location = /repo {
+        return 404;
+    }
+
+    location ^~ /repo/ {
+        return 404;
+    }
+
     location / {
         try_files $uri $uri/ =404;
     }
@@ -154,32 +164,3 @@ server {
     add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
     return 308 https://xsharp-lang.xyz$request_uri;
 }
-
-server {
-    listen 443 ssl;
-    listen [::]:443 ssl;
-    server_name api.xsharp-lang.xyz;
-    server_tokens off;
-
-    ssl_certificate /etc/letsencrypt/live/xsharp-lang.xyz/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/xsharp-lang.xyz/privkey.pem;
-    include /etc/letsencrypt/options-ssl-nginx.conf;
-    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
-
-    add_header Referrer-Policy "no-referrer" always;
-    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header X-Frame-Options "DENY" always;
-
-    client_max_body_size 1m;
-
-    location / {
-        proxy_http_version 1.1;
-        proxy_pass http://127.0.0.1:5080;
-        proxy_set_header Host $host;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header X-Forwarded-Proto https;
-        proxy_set_header X-Real-IP $remote_addr;
-    }
-}