Skip to content

Commit dd5e340

Browse files
vdavidvdavid
committed
Website: Allow Remark42 comments iframe in CSP
- `frame-src` was missing `comments.getcmdr.com`, blocking the comment widget from loading. `script-src` and `connect-src` already had it. - Also added tooling docs
1 parent 1d666a7 commit dd5e340

2 files changed

Lines changed: 66 additions & 4 deletions

File tree

‎apps/website/nginx.conf‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ server {
2121
add_header X-Frame-Options "SAMEORIGIN" always;
2222
add_header X-Content-Type-Options "nosniff" always;
2323
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
24-
add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://comments.getcmdr.com https://*.paddle.com 'unsafe-inline'; style-src 'self' https://*.paddle.com 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self' https://comments.getcmdr.com https://*.paddle.com; worker-src 'self' blob: data:; frame-src https://*.paddle.com" always;
24+
add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://comments.getcmdr.com https://*.paddle.com 'unsafe-inline'; style-src 'self' https://*.paddle.com 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self' https://comments.getcmdr.com https://*.paddle.com; worker-src 'self' blob: data:; frame-src https://comments.getcmdr.com https://*.paddle.com" always;
2525
}
2626

2727
# HTML files - always revalidate to pick up new asset hashes
@@ -30,7 +30,7 @@ server {
3030
add_header X-Frame-Options "SAMEORIGIN" always;
3131
add_header X-Content-Type-Options "nosniff" always;
3232
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
33-
add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://comments.getcmdr.com https://*.paddle.com 'unsafe-inline'; style-src 'self' https://*.paddle.com 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self' https://comments.getcmdr.com https://*.paddle.com; worker-src 'self' blob: data:; frame-src https://*.paddle.com" always;
33+
add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://comments.getcmdr.com https://*.paddle.com 'unsafe-inline'; style-src 'self' https://*.paddle.com 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self' https://comments.getcmdr.com https://*.paddle.com; worker-src 'self' blob: data:; frame-src https://comments.getcmdr.com https://*.paddle.com" always;
3434
}
3535

3636
# JSON data files (like latest.json) - revalidate frequently
@@ -39,7 +39,7 @@ server {
3939
add_header X-Frame-Options "SAMEORIGIN" always;
4040
add_header X-Content-Type-Options "nosniff" always;
4141
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
42-
add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://comments.getcmdr.com https://*.paddle.com 'unsafe-inline'; style-src 'self' https://*.paddle.com 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self' https://comments.getcmdr.com https://*.paddle.com; worker-src 'self' blob: data:; frame-src https://*.paddle.com" always;
42+
add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://comments.getcmdr.com https://*.paddle.com 'unsafe-inline'; style-src 'self' https://*.paddle.com 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self' https://comments.getcmdr.com https://*.paddle.com; worker-src 'self' blob: data:; frame-src https://comments.getcmdr.com https://*.paddle.com" always;
4343
}
4444

4545
# SPA fallback - serve index.html for all routes
@@ -48,7 +48,7 @@ server {
4848
add_header X-Frame-Options "SAMEORIGIN" always;
4949
add_header X-Content-Type-Options "nosniff" always;
5050
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
51-
add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://comments.getcmdr.com https://*.paddle.com 'unsafe-inline'; style-src 'self' https://*.paddle.com 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self' https://comments.getcmdr.com https://*.paddle.com; worker-src 'self' blob: data:; frame-src https://*.paddle.com" always;
51+
add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://comments.getcmdr.com https://*.paddle.com 'unsafe-inline'; style-src 'self' https://*.paddle.com 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self' https://comments.getcmdr.com https://*.paddle.com; worker-src 'self' blob: data:; frame-src https://comments.getcmdr.com https://*.paddle.com" always;
5252
try_files $uri $uri/ /index.html;
5353
}
5454
}

‎docs/tooling/remark42.md‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
# Remark42 (comments)
2+
3+
Self-hosted commenting engine (v1.15.0). Runs as a Docker container alongside the website on the Hetzner VPS.
4+
5+
- **Host URL**: https://comments.getcmdr.com
6+
- **Docker image**: `umputun/remark42:v1.15.0`
7+
- **Container name**: `remark42`
8+
- **Docker Compose**: `apps/website/docker-compose.yml`
9+
10+
## Sites served
11+
12+
| Site ID | Website | Remark42 host |
13+
| --- | --- | --- |
14+
| `getcmdr` | getcmdr.com blog | `comments.getcmdr.com` (this instance) |
15+
16+
To add a site, append its ID to the `SITE=` env var (comma-separated) and restart the container.
17+
18+
## Infrastructure
19+
20+
- **DNS**: A record `comments.getcmdr.com` → `37.27.245.171` (Cloudflare, NOT proxied)
21+
- **Caddy route**: `comments.getcmdr.com { reverse_proxy remark42:8080 }` (in `hetzner-server` repo)
22+
- **Data**: Docker volume `remark42-data` mounted at `/srv/var` inside the container
23+
24+
## Required secrets
25+
26+
Stored on the server at `apps/website/.env`:
27+
28+
| Variable | Purpose |
29+
| --- | --- |
30+
| `REMARK42_SECRET` | Signing secret. Generate with `openssl rand -hex 32` |
31+
| `AUTH_GITHUB_CID` | GitHub OAuth app client ID |
32+
| `AUTH_GITHUB_CSEC` | GitHub OAuth app client secret |
33+
| `AUTH_GOOGLE_CID` | Google OAuth app client ID |
34+
| `AUTH_GOOGLE_CSEC` | Google OAuth app client secret |
35+
36+
## OAuth callback URLs
37+
38+
- **GitHub**: `https://comments.getcmdr.com/auth/github/callback`
39+
- **Google**: `https://comments.getcmdr.com/auth/google/callback`
40+
41+
These must match exactly in the OAuth app settings on GitHub / Google Cloud Console.
42+
43+
## Common operations
44+
45+
```bash
46+
# Start the container
47+
docker compose up -d remark42
48+
49+
# Health check (expect "pong")
50+
curl -s https://comments.getcmdr.com/ping
51+
52+
# View logs
53+
docker logs remark42
54+
55+
# Add a new site: append to the SITE= env var (comma-separated), then restart
56+
docker compose up -d remark42
57+
```
58+
59+
## Related files
60+
61+
- [`apps/website/src/components/Remark42Comments.astro`](../../apps/website/src/components/Remark42Comments.astro) — Astro component that embeds the comment widget
62+
- [`docs/guides/deploying-remark42.md`](../guides/deploying-remark42.md) — Step-by-step deployment guide

0 commit comments

Comments
 (0)
⚡