move shrine files out of public. use x-sendfile to send files for security.

This commit is contained in:
Christoph Haas 2025-06-16 00:24:11 +02:00
parent 8e66fb28db
commit b601b2bbb6
11 changed files with 164 additions and 140 deletions

View file

@ -74,6 +74,15 @@ Rails.application.configure do
# routes, locales, etc. This feature depends on the listen gem.
config.file_watcher = ActiveSupport::EventedFileUpdateChecker
# Let the "thrust" web server handle sending images. It allows to route all
# images through the Rails application and prevent unauthorized access to
# images that are pending moderation. (A common problem with spammers uploading
# smartphone screenshots of card games.)
config.action_dispatch.x_sendfile_header = 'X-Sendfile'
# Where Shrine stores the screenshots
config.shrine_storage_path = ENV.fetch('SHRINE_STORAGE_PATH', 'shrine')
config.package_sources = [
{
description: 'Debian Unstable (Sid)', type: 'apt', url: 'http://ftp.de.debian.org/debian/dists/sid',