fo

mnemo_cards_backend/PROGRESS.md

@@ -28,10 +28,11 @@
 - `forgejo-nginx.conf` - Production-ready nginx configuration with IP access blocking
 
 **Security Features Added:**
-- ✅ IP address access blocking (only domain access allowed)
+- ✅ IP address access blocking for both HTTP and HTTPS (only domain access allowed)
 - ✅ Automatic Forgejo ROOT_URL configuration fix
 - ✅ SSL certificate validation for domain access
 - ✅ Service restart after configuration changes
+- ✅ Comprehensive testing for IP blocking and ROOT_URL validation
 
 **Next Action:** Run updated setup script on server to activate domain configuration with IP blocking and ROOT_URL fix
 

mnemo_cards_web_v2/deploy/fix-forgejo-config.sh

@@ -128,16 +128,29 @@ else
     fi
 fi
 
+# Apply updated nginx configuration
+print_status "Applying updated nginx configuration..."
+if [ -f "/etc/nginx/sites-available/forgejo" ]; then
+    print_status "Copying updated nginx config..."
+    sudo cp "$SCRIPT_DIR/forgejo-nginx.conf" "/etc/nginx/sites-available/forgejo"
+    print_success "Nginx config updated"
+else
+    print_warning "Forgejo nginx config not found, copying..."
+    sudo cp "$SCRIPT_DIR/forgejo-nginx.conf" "/etc/nginx/sites-available/forgejo"
+    sudo ln -sf "/etc/nginx/sites-available/forgejo" "/etc/nginx/sites-enabled/forgejo"
+    print_success "Nginx config installed"
+fi
+
 # Check nginx configuration and reload
 print_status "Checking nginx configuration..."
-if nginx -t 2>/dev/null; then
+if sudo nginx -t 2>/dev/null; then
     print_success "Nginx configuration is valid"
     print_status "Reloading nginx..."
     sudo systemctl reload nginx
     print_success "Nginx reloaded"
 else
     print_error "Nginx configuration has errors!"
-    nginx -t
+    sudo nginx -t
 fi
 
 print_success "Forgejo configuration fix completed!"

mnemo_cards_web_v2/deploy/forgejo-nginx.conf

@@ -1,6 +1,14 @@
-# Block access by IP address
+# Block all HTTP access except for code.mnemo-cards.online
 server {
     listen 80 default_server;
+    server_name _;
+
+    # Block all HTTP requests to IP addresses or other domains
+    return 444;
+}
+
+# Block all HTTPS access except for code.mnemo-cards.online
+server {
     listen 443 ssl default_server;
     server_name _;
 
@@ -9,7 +17,7 @@ server {
     ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key;
     ssl_protocols TLSv1.2 TLSv1.3;
 
-    # Return 444 (connection closed without response) for IP access
+    # Block all HTTPS requests to IP addresses or other domains
     return 444;
 }
 

mnemo_cards_web_v2/deploy/test-forgejo-domain.sh

@@ -68,13 +68,22 @@ else
     print_warning "HTTPS access: $HTTPS_STATUS (may be normal for Forgejo auth redirects)"
 fi
 
-# Test that IP access is blocked
-print_status "Testing that IP access is blocked..."
-IP_BLOCK_STATUS=$(curl -s -o /dev/null -w "%{http_code}" --max-time 5 https://147.45.152.129/)
-if [ "$IP_BLOCK_STATUS" = "444" ] || [ "$IP_BLOCK_STATUS" = "000" ]; then
-    print_success "IP access blocked: $IP_BLOCK_STATUS ✓"
+# Test that HTTP IP access is blocked
+print_status "Testing that HTTP IP access is blocked..."
+HTTP_IP_BLOCK_STATUS=$(curl -s -o /dev/null -w "%{http_code}" --max-time 5 http://147.45.152.129/)
+if [ "$HTTP_IP_BLOCK_STATUS" = "444" ] || [ "$HTTP_IP_BLOCK_STATUS" = "000" ]; then
+    print_success "HTTP IP access blocked: $HTTP_IP_BLOCK_STATUS ✓"
 else
-    print_warning "IP access not blocked: $IP_BLOCK_STATUS (should be 444)"
+    print_warning "HTTP IP access not blocked: $HTTP_IP_BLOCK_STATUS (should be 444)"
+fi
+
+# Test that HTTPS IP access is blocked
+print_status "Testing that HTTPS IP access is blocked..."
+HTTPS_IP_BLOCK_STATUS=$(curl -s -o /dev/null -w "%{http_code}" --max-time 5 --insecure https://147.45.152.129/)
+if [ "$HTTPS_IP_BLOCK_STATUS" = "444" ] || [ "$HTTPS_IP_BLOCK_STATUS" = "000" ]; then
+    print_success "HTTPS IP access blocked: $HTTPS_IP_BLOCK_STATUS ✓"
+else
+    print_warning "HTTPS IP access not blocked: $HTTPS_IP_BLOCK_STATUS (should be 444)"
 fi
 
 # Test SSL certificate