ci: fix gitleaks module path, compose env file, and nginx limit_req_zone scope

- secrets-scan: gitleaks module path was renamed from
  github.com/gitleaks/gitleaks/v8 to github.com/zricethezav/gitleaks/v8
- docker-compose-check: create backend/.env from .env.example before
  running docker compose config (env file required by compose.yml)
- nginx: move limit_req_zone directives outside server block to http
  level, where nginx requires them

.gitea/workflows/ci.yaml

@@ -37,7 +37,7 @@ jobs:
           cache: false
 
       - name: Install gitleaks
-        run: go install github.com/gitleaks/gitleaks/v8@latest
+        run: go install github.com/zricethezav/gitleaks/v8@latest
 
       - name: Detect secrets
         run: gitleaks detect --source . --verbose --no-banner
@@ -748,6 +748,9 @@ jobs:
       - name: Install docker CLI
         run: apk add --no-cache docker-cli docker-compose
 
+      - name: Create env file for compose validation
+        run: cp .env.example backend/.env
+
       - name: Validate compose.yml
         run: docker compose -f compose.yml config --quiet
 

nginx/conf.d/default.conf

@@ -1,6 +1,10 @@
 # Define cache for API responses
 proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=api_cache:10m max_size=100m inactive=60m use_temp_path=off;
 
+# Rate limiting (per IP) — must be at http level, not inside server block
+limit_req_zone $binary_remote_addr zone=api_limit:10m rate=20r/m;
+limit_req_zone $binary_remote_addr zone=dav_limit:10m rate=100r/m;
+
 server {
     listen 80;
     listen 443 ssl http2;
@@ -17,10 +21,6 @@ server {
     add_header X-XSS-Protection "1; mode=block";
     add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; frame-ancestors 'none';" always;
 
-    # Rate limiting (per IP)
-    limit_req_zone $binary_remote_addr zone=api_limit:10m rate=20r/m;
-    limit_req_zone $binary_remote_addr zone=dav_limit:10m rate=100r/m;
-
     # Serve static frontend
     root /usr/share/nginx/html;
     index index.html;