snapshot of https://github.com/zulip/zulip.git @ 48c69911c7dd4e03b20552eb3bd77ad8151c1357 (2026-09-15)

puppet/zulip/files/nginx/zulip-include-common/api_headers

@@ -0,0 +1,4 @@
+include /etc/nginx/zulip-include/headers;
+add_header Access-Control-Allow-Origin * always;
+add_header Access-Control-Allow-Headers Authorization always;
+add_header Access-Control-Allow-Methods 'GET, POST, DELETE, PUT, PATCH, HEAD' always;

puppet/zulip/files/nginx/zulip-include-common/certbot

@@ -0,0 +1,4 @@
+# Directory needed for certbot --webroot to work.
+location /.well-known/acme-challenge/ {
+    alias /var/lib/zulip/certbot-webroot/.well-known/acme-challenge/;
+}

puppet/zulip/files/nginx/zulip-include-common/headers

@@ -0,0 +1,10 @@
+# Enable HSTS: tell browsers to always use HTTPS
+add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload" always;
+
+# Set X-Frame-Options to deny to prevent clickjacking
+add_header X-Frame-Options DENY always;
+
+add_header X-Content-Type-Options nosniff always;
+
+add_header Referrer-Policy strict-origin-when-cross-origin always;
+add_header Cross-Origin-Opener-Policy same-origin always;

puppet/zulip/files/nginx/zulip-include-common/immutable_headers

@@ -0,0 +1,4 @@
+include /etc/nginx/zulip-include/headers;
+add_header Cache-Control "public, max-age=31536000, immutable";
+add_header Access-Control-Allow-Origin *;
+add_header Timing-Allow-Origin *;

puppet/zulip/files/nginx/zulip-include-common/proxy

@@ -0,0 +1,11 @@
+proxy_http_version 1.1;
+# Clearing the Connection header is required for keepalives from the load balancer
+# http://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive
+proxy_set_header Connection "";
+proxy_set_header Host $host;
+proxy_set_header X-Forwarded-Proto $trusted_x_forwarded_proto;
+proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+proxy_set_header X-Real-Ip $trusted_remote_addr;
+proxy_set_header X-Proxy-Misconfiguration $x_proxy_misconfiguration;
+proxy_next_upstream off;
+proxy_redirect off;

puppet/zulip/files/nginx/zulip-include-common/proxy_longpolling

@@ -0,0 +1,3 @@
+include /etc/nginx/zulip-include/proxy;
+proxy_buffering off;
+proxy_read_timeout 1200;

puppet/zulip/files/nginx/zulip-include-common/tornado_cors_headers

@@ -0,0 +1,4 @@
+include /etc/nginx/zulip-include/headers;
+add_header Access-Control-Allow-Origin * always;
+add_header Access-Control-Allow-Headers Authorization always;
+add_header Access-Control-Allow-Methods 'OPTIONS, GET, DELETE' always;