imp: nginx config

Author: Tardo

templates/nginx.conf.template

@@ -12,11 +12,11 @@ events {
 pid /usr/local/etc/adblock2privoxy/nginx-adblock2privoxy.pid;
 
 # error_log /opt/local/var/log/nginx/error-adblock2privoxy.log warn;
-error_log /dev/null;
+error_log stderr warn;
 
 http {
   # access_log /opt/local/var/log/nginx/access-adblock2privoxy.log;
-  access_log /dev/null;
+  access_log /dev/stdout;
 
   # Increase client_max_body_size to handle larger requests, uncommented for clarity
   client_max_body_size 64M;
@@ -53,14 +53,9 @@ http {
     #root = --webDir parameter value
     root /usr/local/etc/adblock2privoxy/css;
 
-    # If useHTTP is set:
-    # Ensure that http://localhost:8119/ is a legitimate (200 return code)
-    # default page; use as iOS proxy.pac blackhole
-    # Test with curl -I --proxy http://127.0.0.1:8119 http://www.foo.com/bar?q=snafoo
-    location / {
-      return 301 http://$server_name:$server_port/@blackhole?;
-      # rewrite ^ /default.html break;
-    }
+    # ────────────────────────────────────────────────
+    # Blackhole
+    # ────────────────────────────────────────────────
 
     location ~ ^/@blackhole {
       default_type text/html;
@@ -69,29 +64,41 @@ http {
       # rewrite ^ /default.html break;
     }
 
+    # ────────────────────────────────────────────────
+    # ab2p resources
+    # ────────────────────────────────────────────────
+
     location ~ ^/+(ab2p(?:\.common)?\.css) {
       # ab2p.css in top-level directory
       default_type text/css;
-      add_header X-Content-Type-Options nosniff;
-      add_header Cache-Control "public, max-age=31536000, immutable";
-      try_files $uri $1;
+      add_header X-Content-Type-Options nosniff always;
+      add_header Cache-Control "public, max-age=31536000, immutable" always;
+      try_files $uri $1 =404;
     }
 
     location ~ ^/[^/.]+\..+/ab2p\.css$ {
       # first reverse domain names order
       default_type text/css;
-      add_header X-Content-Type-Options nosniff;
-      add_header Cache-Control "public, max-age=31536000, immutable";
+      add_header X-Content-Type-Options nosniff always;
+      add_header Cache-Control "public, max-age=31536000, immutable" always;
       rewrite ^/([^/]*?)\.([^/.]+)(?:\.([^/.]+))?(?:\.([^/.]+))?(?:\.([^/.]+))?(?:\.([^/.]+))?(?:\.([^/.]+))?(?:\.([^/.]+))?(?:\.([^/.]+))?/ab2p.css$ /$9/$8/$7/$6/$5/$4/$3/$2/$1/ab2p.css last;
     }
 
     location ~ (^.*/+)[^/]+/+ab2p\.css {
       # then try to get CSS for current domain
       # if it is unavailable - get CSS for parent domain
       default_type text/css;
-      add_header X-Content-Type-Options nosniff;
-      add_header Cache-Control "public, max-age=31536000, immutable";
-      try_files $uri $1ab2p.css;
+      add_header X-Content-Type-Options nosniff always;
+      add_header Cache-Control "public, max-age=31536000, immutable" always;
+      try_files $uri $1ab2p.css =404;
+    }
+
+    # ────────────────────────────────────────────────
+    # Fallback
+    # ────────────────────────────────────────────────
+
+    location / {
+      return 204;
     }
   }
 }

tests/test_privoxy.py

@@ -69,6 +69,8 @@ def test_http_adblock_css_filters(self, docker_privoxy, make_request, env_info):
         assert resp.status_code == 200
         mime_type = resp.headers.get("Content-Type")
         assert mime_type == "text/css"
+        resp = requests.get(f"https://{env_info['ip']}/this.not.exists.css")
+        assert resp.status_code == 204
 
     def test_https_adblock_css_filters(self, docker_privoxy, make_request, env_info):
         resp = requests.get(
@@ -78,6 +80,11 @@ def test_https_adblock_css_filters(self, docker_privoxy, make_request, env_info)
         assert resp.status_code == 200
         mime_type = resp.headers.get("Content-Type")
         assert mime_type == "text/css"
+        resp = requests.get(
+            f"https://{env_info['ip']}/this.not.exists.css",
+            verify="./tests/privoxy-ca-bundle.crt",
+        )
+        assert resp.status_code == 204
 
     def test_http_privman_blocklist(self, docker_privoxy, make_request, exec_privman):
         resp = exec_privman(docker_privoxy, "--add-blocklist", ".google.")