CanuteTheGreat/nginx-config-auditor
Watch
1
0
Fork
You've already forked nginx-config-auditor
 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions
2 releases 4 tags
  • v1.2.0 68c41e4df7

    nginx-config-auditor v1.2.0
    All checks were successful
    tests / test (3.8) (push) Successful in 44s
    Details
    tests / test (3.13) (push) Successful in 44s
    Details
    release / release (push) Successful in 25s
    Details
    Stable

    Ghost released this 2026-10-16 19:57:49 -07:00 | 21 commits to master since this release

    • Includes are followed (globs too) and the merged tree is audited, so headers or TLS settings set in an
      included snippet no longer produce false "missing" findings in every file. A directory with an
      nginx.conf is audited from it (files it never includes are listed as INFO); --local and --dump
      audit nginx -T output; --docker now runs nginx -T inside the container (docker cp as fallback).
    • Security headers are checked per server, with http-level headers inherited exactly as nginx does.
    • New checks: add_header redefinition in a location dropping inherited security headers, alias path
      traversal (location/alias trailing-slash mismatch), valid_referers none, Host $http_host,
      $uri/$document_uri in headers or redirects, unanchored Origin/Referer regexes, multi-line header
      values, security headers without always, short HSTS max-age.
    • A real parser (quotes, escapes, ${var}, multi-line directives); a config nginx can't parse exits 2.
    • --fail-on (default high, the previous behaviour).
    • Installable as a package: pipx install git+https://git.canutethegreat.com/CanuteTheGreat/nginx-config-auditor.git
      puts a nginx-config-auditor command on PATH (pyproject.toml, MIT license metadata).
    • --version flag.
    • Exit codes follow the shared convention: 0 = clean, 1 = findings at/above the gate, 2 = error or bad usage.
    • Every tag now publishes a Forgejo release with this changelog, the wheel, the sdist and SHA256SUMS.
    • CI installs the package with pip in a clean venv and checks --version/--help on every push.

    Install

    pipx install git+https://git.canutethegreat.com/CanuteTheGreat/nginx-config-auditor.git@v1.2.0
# or the wheel attached to this release:
pipx install https://git.canutethegreat.com/CanuteTheGreat/nginx-config-auditor/releases/download/v1.2.0/nginx_config_auditor-1.2.0-py3-none-any.whl
# or the single file (stdlib-only Python 3):
curl -fsSLO https://git.canutethegreat.com/CanuteTheGreat/nginx-config-auditor/releases/download/v1.2.0/nginx_config_auditor.py

    SHA-256

    769805c02d23162ef8d5f152bec2ded875213ba8a08bc33575bdbcb8cc1aff92  nginx_config_auditor.py
3465a0f82eaf573b39607e1dd8f4985142f6cf82f341b5209f51cf5f78dc0548  nginx_config_auditor-1.2.0-py3-none-any.whl
d5e271c2afe5e1aabcdfc54350abfd75c0c61b434c66605796815fab7b4f1cb8  nginx_config_auditor-1.2.0.tar.gz
    Downloads