From b3ec8c012221df98d64f477ddd7ed80e0a183893 Mon Sep 17 00:00:00 2001 From: Tim Wundenberg Date: Tue, 31 Dec 2024 12:01:27 +0100 Subject: [PATCH] feat(observability): remove umami to reduce complexity --- Readme.md | 2 +- handler/middleware/security_headers.go | 6 +++--- main_test.go | 6 +++--- template/layout.templ | 5 +---- 4 files changed, 8 insertions(+), 11 deletions(-) diff --git a/Readme.md b/Readme.md index 88f83ba..360cfba 100644 --- a/Readme.md +++ b/Readme.md @@ -9,7 +9,7 @@ stackFAST includes everything you need to build your App. Focus yourself on deve The blueprint contains the following features: - Authentication: Users can login, logout, register and reset their password. For increased security TOTP is available aswell. -- Observability: The stack contains an Grafana+Prometheus instance for basic monitoring. You are able to add alerts and get notified on your phone. For web analytics umami is included, which is an lighweight self hosted alternative to google analytics. +- Observability: The stack contains an Grafana+Prometheus instance for basic monitoring. You are able to add alerts and get notified on your phone. - Mail: You are able to send mail with SMTP. You still need an external Mail Server, but a guide on how to set that up with a custom domain is included. - SSL: This is included by using traefik as reverse proxy. It handles SSL certificates automatically. Furthermore all services are accessible through subdomains. Best thing is, you can add your more with 3 lines of code - Actual Stack: SSG SvelteKit + Tailwindcss + DaisyUI + GO Backend for easy and fast feature development diff --git a/handler/middleware/security_headers.go b/handler/middleware/security_headers.go index 959cf74..7a5a2a5 100644 --- a/handler/middleware/security_headers.go +++ b/handler/middleware/security_headers.go @@ -15,14 +15,14 @@ func SecurityHeaders(serverSettings *types.Settings) func(http.Handler) http.Han w.Header().Set("Access-Control-Allow-Methods", "GET, POST, DELETE") w.Header().Set("Content-Security-Policy", "default-src 'none'; "+ - "script-src 'self' https://umami.me-fit.eu; "+ - "connect-src 'self' https://umami.me-fit.eu; "+ + "script-src 'self'; "+ + "connect-src 'self'; "+ "img-src 'self'; "+ "style-src 'self'; "+ "form-action 'self'; "+ "frame-ancestors 'none'; ", ) - w.Header().Set("Cross-Origin-Resource-Policy", "same-site") // same-site, as same origin prohibits umami + w.Header().Set("Cross-Origin-Resource-Policy", "same-origin") w.Header().Set("Cross-Origin-Opener-Policy", "same-origin") w.Header().Set("Cross-Origin-Embedder-Policy", "require-corp") w.Header().Set("Permissions-Policy", "geolocation=(), camera=(), microphone=(), interest-cohort=()") diff --git a/main_test.go b/main_test.go index cf1e9c3..b7f3f19 100644 --- a/main_test.go +++ b/main_test.go @@ -82,15 +82,15 @@ func TestIntegrationSecurityHeader(t *testing.T) { value = resp.Header.Get("Content-Security-Policy") assert.Equal(t, "default-src 'none'; "+ - "script-src 'self' https://umami.me-fit.eu; "+ - "connect-src 'self' https://umami.me-fit.eu; "+ + "script-src 'self'; "+ + "connect-src 'self'; "+ "img-src 'self'; "+ "style-src 'self'; "+ "form-action 'self'; "+ "frame-ancestors 'none';", value) value = resp.Header.Get("Cross-Origin-Resource-Policy") - assert.Equal(t, "same-site", value) + assert.Equal(t, "same-origin", value) value = resp.Header.Get("Cross-Origin-Opener-Policy") assert.Equal(t, "same-origin", value) diff --git a/template/layout.templ b/template/layout.templ index 78fe1f7..0f424b3 100644 --- a/template/layout.templ +++ b/template/layout.templ @@ -1,6 +1,6 @@ package template -templ Layout(slot templ.Component, user templ.Component, environment string) { +templ Layout(slot templ.Component, user templ.Component) { @@ -10,9 +10,6 @@ templ Layout(slot templ.Component, user templ.Component, environment string) { - if environment == "prod" { - - }