ci: run gixy to detect nginx config issues

files/nginx/odk.conf.template

@@ -1,5 +1,6 @@
 server {
   listen 443 default_server ssl;
+  server_tokens off;
 
   ssl_certificate /etc/nginx/ssl/nginx.default.crt;
   ssl_certificate_key /etc/nginx/ssl/nginx.default.key;

files/nginx/redirector.conf

@@ -5,6 +5,7 @@ server {
     listen 80 reuseport;
     listen [::]:80 reuseport;
     server_name ${DOMAIN};
+    server_tokens off;
 
     # Anything requesting this particular URL should be served content from
     # Certbot's folder so the HTTP-01 ACME challenges can be completed for the
@@ -24,6 +25,7 @@ server {
 server {
     listen 80 default_server;
     listen [::]:80 default_server;
+    server_tokens off;
 
     return 421;
 }

test/nginx/run-tests.sh

@@ -39,4 +39,15 @@ wait_for_http_response 5 localhost:9000 421
 
 npm run test:nginx
 
+log "Linting nginx config with gixy-ng..."
+# see: https://github.com/dvershinin/gixy
+docker_compose exec nginx bash -euc '
+  apt update
+  apt install -y python3-venv
+  python3 -m venv .venv
+  . .venv/bin/activate
+  pip install gixy-ng
+  gixy -lll
+'
+
 log "Completed OK."