From fbb8837981a7c899c757e0cfe2e2b76e8996f66c Mon Sep 17 00:00:00 2001
From: Stephen Adamson <popertots@gmail.com>
Date: Fri, 10 Jul 2026 10:22:32 +0100
Subject: [PATCH] ci: fix gitleaks module path, compose env file, and nginx
 limit_req_zone scope

- secrets-scan: gitleaks module path was renamed from
  github.com/gitleaks/gitleaks/v8 to github.com/zricethezav/gitleaks/v8
- docker-compose-check: create backend/.env from .env.example before
  running docker compose config (env file required by compose.yml)
- nginx: move limit_req_zone directives outside server block to http
  level, where nginx requires them
---
 .gitea/workflows/ci.yaml  | 5 ++++-
 nginx/conf.d/default.conf | 8 ++++----
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index f027440..8b79bde 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -37,7 +37,7 @@ jobs:
           cache: false
 
       - name: Install gitleaks
-        run: go install github.com/gitleaks/gitleaks/v8@latest
+        run: go install github.com/zricethezav/gitleaks/v8@latest
 
       - name: Detect secrets
         run: gitleaks detect --source . --verbose --no-banner
@@ -748,6 +748,9 @@ jobs:
       - name: Install docker CLI
         run: apk add --no-cache docker-cli docker-compose
 
+      - name: Create env file for compose validation
+        run: cp .env.example backend/.env
+
       - name: Validate compose.yml
         run: docker compose -f compose.yml config --quiet
 
diff --git a/nginx/conf.d/default.conf b/nginx/conf.d/default.conf
index 771933b..7f8ef61 100644
--- a/nginx/conf.d/default.conf
+++ b/nginx/conf.d/default.conf
@@ -1,6 +1,10 @@
 # Define cache for API responses
 proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=api_cache:10m max_size=100m inactive=60m use_temp_path=off;
 
+# Rate limiting (per IP) — must be at http level, not inside server block
+limit_req_zone $binary_remote_addr zone=api_limit:10m rate=20r/m;
+limit_req_zone $binary_remote_addr zone=dav_limit:10m rate=100r/m;
+
 server {
     listen 80;
     listen 443 ssl http2;
@@ -17,10 +21,6 @@ server {
     add_header X-XSS-Protection "1; mode=block";
     add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; frame-ancestors 'none';" always;
 
-    # Rate limiting (per IP)
-    limit_req_zone $binary_remote_addr zone=api_limit:10m rate=20r/m;
-    limit_req_zone $binary_remote_addr zone=dav_limit:10m rate=100r/m;
-
     # Serve static frontend
     root /usr/share/nginx/html;
     index index.html;