diff --git a/.prettierignore b/.prettierignore index b5502c0802..e11b132198 100644 --- a/.prettierignore +++ b/.prettierignore @@ -85,3 +85,6 @@ core backend/backend-production.* **/temp/** + +# monaco editor +**/vs/loader.js diff --git a/backend/npx.js b/backend/npx.js index e1a30cc38b..2e04c8da32 100644 --- a/backend/npx.js +++ b/backend/npx.js @@ -66,6 +66,9 @@ app.get('/core-ui/*', (_, res) => app.use('/backend', handleRequest); +// serve Monaco editor static files +app.use('/vs', express.static(path.join(__dirname, 'vs'))); + app.use('/', express.static(path.join(__dirname, 'core'))); app.get('/*', (_, res) => res.sendFile(path.join(__dirname + '/core/index.html')), diff --git a/backend/vs b/backend/vs new file mode 120000 index 0000000000..bc35daff37 --- /dev/null +++ b/backend/vs @@ -0,0 +1 @@ +../node_modules/monaco-editor/min/vs diff --git a/core-ui/nginx.conf b/core-ui/nginx.conf index 8fffa19a38..055ff3fabb 100644 --- a/core-ui/nginx.conf +++ b/core-ui/nginx.conf @@ -55,7 +55,6 @@ http { location / { access_log /dev/stdout combined if=$nonSuccessful; #limit_req zone=mylimit burst=30; # we might consider using this feature; for now it destroys the performance completely - set $monacoEditorCdn https://cdn.jsdelivr.net; try_files $uri$args $uri$args/ $uri $uri/ /; add_header 'Cache-Control' 'public, max-age=300'; @@ -64,7 +63,7 @@ http { add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains'; add_header X-XSS-Protection '1; mode=block'; add_header X-Frame-Options 'SAMEORIGIN'; - add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'sha256-7fF0zlMDaJyxa8K3gkd0Gnt657Obx/gdAct0hR/pdds=' $monacoEditorCdn data: blob:; style-src 'self' 'unsafe-inline' $monacoEditorCdn; connect-src 'self' * https://* wss://*; font-src 'self' $monacoEditorCdn data:; frame-ancestors https://*; object-src 'none'; media-src 'self'; form-action 'self'; img-src * data:; child-src * blob:; worker-src 'self' blob: data:;"; + add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'sha256-7fF0zlMDaJyxa8K3gkd0Gnt657Obx/gdAct0hR/pdds=' 'sha256-bjOtDHhqB+wVlyFDAxz9e0RvTn+EEec/Z4mpjUjNvAs=' data: blob:; style-src 'self' 'unsafe-inline'; connect-src 'self' * https://* wss://*; font-src 'self' data:; frame-ancestors https://*; object-src 'none'; media-src 'self'; form-action 'self'; img-src * data:; child-src * blob:; worker-src 'self' blob: data:;"; } diff --git a/core-ui/public/vs b/core-ui/public/vs new file mode 120000 index 0000000000..5e0c30025c --- /dev/null +++ b/core-ui/public/vs @@ -0,0 +1 @@ +../../node_modules/monaco-editor/min/vs \ No newline at end of file diff --git a/core/.gitignore b/core/.gitignore index 78b64cb7ed..74223ff451 100644 --- a/core/.gitignore +++ b/core/.gitignore @@ -41,4 +41,4 @@ testem.log Thumbs.db pkup.sh -src/assets/luigi-core +src/assets/libs diff --git a/core/.prettierignore b/core/.prettierignore index c4db424645..2cd4402fcf 100644 --- a/core/.prettierignore +++ b/core/.prettierignore @@ -1,2 +1,2 @@ -src/assets/luigi-core +src/assets/libs src/assets/luigiConfig.bundle.js diff --git a/core/Dockerfile b/core/Dockerfile index f7bdee780f..a156a99324 100644 --- a/core/Dockerfile +++ b/core/Dockerfile @@ -22,7 +22,7 @@ ARG app_name=core COPY ./${app_name}/nginx/nginx.conf /etc/nginx/nginx.conf COPY --from=builder /app/${app_name}/src /usr/share/nginx/html/ -COPY --from=builder /app/${app_name}/src/assets/luigi-core /usr/share/nginx/html/assets/luigi-core +COPY --from=builder /app/${app_name}/src/assets/libs /usr/share/nginx/html/assets/libs COPY --from=builder /app/${app_name}/licenses/ /app/licenses/ COPY --from=builder /app/${app_name}/nginx/conf.d /etc/nginx/conf.d/ COPY --from=builder /app/${app_name}/nginx/nginx.conf /etc/nginx/ diff --git a/core/nginx/nginx.conf b/core/nginx/nginx.conf index 5d515225e0..12de0dab6c 100644 --- a/core/nginx/nginx.conf +++ b/core/nginx/nginx.conf @@ -61,7 +61,7 @@ http { add_header 'Cache-Control' 'public, max-age=300'; add_header X-Frame-Options 'SAMEORIGIN'; - add_header Content-Security-Policy "default-src 'self'; script-src https://cdnjs.cloudflare.com/ajax/libs/js-yaml/4.0.0/js-yaml.js 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' https://* wss://*; font-src 'self' data:; frame-ancestors 'self'; object-src 'none'; media-src 'self'; form-action 'self'; img-src * data:; child-src * blob:; worker-src 'self' blob:;"; + add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' https://* wss://*; font-src 'self' data:; frame-ancestors 'self'; object-src 'none'; media-src 'self'; form-action 'self'; img-src * data:; child-src * blob:; worker-src 'self' blob:;"; add_header X-Content-Type-Options 'nosniff'; add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains'; add_header X-XSS-Protection '1; mode=block'; diff --git a/core/src/index.html b/core/src/index.html index de702e4027..564147e2e7 100644 --- a/core/src/index.html +++ b/core/src/index.html @@ -11,7 +11,7 @@ - + diff --git a/core/src/logout.html b/core/src/logout.html index 25a2c5650d..4d172dc69f 100644 --- a/core/src/logout.html +++ b/core/src/logout.html @@ -9,7 +9,7 @@ - +