Deny web access to replication bootstrap snapshots

2026-06-01 23:19:04 +02:00
parent 7bb67b0470
commit e41b226529
2 changed files with 8 additions and 0 deletions
@@ -10,6 +10,10 @@
    # CORS is handled at the edge by Traefik's headers middleware.
    # Do not set or strip Access-Control-* headers here to avoid conflicts.

+    # Replication bootstrap snapshots contain sensitive failover credentials.
+    @replication_bootstrap path /storage/replication-bootstrap.json /storage/replication-bootstrap-*
+    respond @replication_bootstrap 404
+
    # PHP handling via FastCGI to php-fpm pool
    php_fastcgi php-staging:9000