search

abhin4v / hastatic

hastatic is a tiny static content web server for Docker
BSD 3-Clause "New" or "Revised" License
69 stars 5 forks source link

CMD/ENTRYPOINT and WORKDIR is not set #3

Open moqmar opened 4 years ago

moqmar commented 4 years ago

It would make it much easier to use hastatic without a custom Dockerfile if the following lines were added:

WORKDIR "/var/www"
ENTRYPOINT ["/usr/bin/hastatic"]
moqmar commented 4 years ago

I decided to also set the port to 80, as it's the default in basically all reverse proxies and also makes sense when directly exposing the container.

beantaxi commented 3 years ago

@moqmar I actually came to Issues to suggest adding exactly these features. Do you have a fork, or some way of using them? If not, I can just 'borrow' your solution from your commit. Thanks!

moqmar commented 3 years ago

No, Haskell isn't something I know or have wanted to learn, so I actually ended up rewriting something similar in Go. It doesn't support HTTPS (as using Docker implies a reverse proxy in most cases), but is quite a bit more configurable than hastatic, and even a bit faster.

beantaxi commented 3 years ago

@moqmar I just fired up web/momar! It works great, but I do have an issue, and I can't raise issues without joining codeberg, which I'd rather not do ...

I was hoping that web/momar would allow disabling CORS, so I can host any type of content, eg font files, without a CORS warning. From a quick look at the code those headers appear hardcoded. I like your choice of ignoring HTTPS, which is unnecessary for simple local testing, and I was wondering if you might feel the same about disabling security headers, at least optionally.

Thanks!

moqmar commented 3 years ago

I agree that that'd be useful & copied your request to the Codeberg repo, together with a suggestion on security headers in general and can probably look into that tomorrow.

TL;DR: only the Referrer-Policy: strict-origin-when-cross-origin header will stay, and there will be an ENABLE_CORS variable that allows hosting web fonts and accessing static content via JavaScript, which will be disabled by default.

Let's not spam this issue here any further, just check back on Thursday, I'll probably have an update ready then. For further questions you can also use my email address in my profile here on GitHub.