From a68301919850cb2c92026b0f9ce9a3e7c31cb0a2 Mon Sep 17 00:00:00 2001 From: Tobias Hallmen Date: Wed, 4 Nov 2026 13:10:09 +0000 Subject: [PATCH] Git-bridge: nginx: only expose git-bridge project endpoints under /git/ (#260) The /git/ location proxied every path to git-bridge, which made its internal routes reachable from the internet: /status, /health_check, /metrics, /diags, /api///postback and the unauthenticated DELETE /api/projects/ used by web on project expiry. Forward only /git/<24 hex project id>[.git]/... (the git smart-HTTP endpoints, which git-bridge protects with Oauth2Filter) and return 404 for everything else under /git/. Web talks to git-bridge directly (GIT_BRIDGE_HOST:GIT_BRIDGE_PORT), not through nginx, so it is not affected. --- server-ce/nginx/overleaf.conf.template | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/server-ce/nginx/overleaf.conf.template b/server-ce/nginx/overleaf.conf.template index 34ff6357dd..0be9b98b4f 100644 --- a/server-ce/nginx/overleaf.conf.template +++ b/server-ce/nginx/overleaf.conf.template @@ -21,7 +21,14 @@ server { proxy_send_timeout 10m; } - location ^~ /git/ { + # Only the git smart-HTTP endpoints of a project (/git/[.git]/...) are + # public. git-bridge's other routes (/status, /health_check, /metrics, /diags, + # /api/...) are meant for the internal network only and must not be reachable. + location /git/ { + return 404; + } + + location ~ "^/git/[0-9a-f]{24}(\.git)?(/|$)" { resolver_timeout 2s; resolver 127.0.0.11 valid=10s; set $git_upstream http://${GIT_BRIDGE_HOST}:${GIT_BRIDGE_PORT};