create-berna-stencil 2.4.2 → 2.5.0

package/README.md

@@ -12,7 +12,7 @@ Building a website from scratch involves a lot of moving parts: templating engin
 - 📁 **Scalable structure** — a clean, opinionated project layout that grows with your needs
 - 🌍 **Open source** — free to use, free to modify, free to share
 
-![Version](https://img.shields.io/badge/version-2.4.2-blue)
+![Version](https://img.shields.io/badge/version-2.5.0-blue)
 ![License](https://img.shields.io/badge/license-Apache--2.0-blue)
 ![Eleventy](https://img.shields.io/badge/11ty-v3.1.2-black)
 

package/bin/create.js

@@ -47,6 +47,7 @@ const MANDATORY_COPY = [
     '_tools',
     '.eleventy.js',
     '.eleventyignore',
+    'nginx.conf',
     'src/backend',
     'src/frontend',
 ];
@@ -120,7 +121,7 @@ src/backend/config.php
 
 const PROJECT_PACKAGE = {
     name:      path.basename(targetDir),
-    version:   '2.4.2',
+    version:   '2.5.0',
     private:   true,
     outputDir: 'out',
     "scripts": {

package/docs/Backend.md

@@ -32,13 +32,23 @@ Copy `config.example.php` to `config.php` and fill in your values:
 ### config.php <small>(`src/backend/`)</small>
 ```php
 return [
-    // Default key for protected endpoints that don't have a specific key in ENDPOINT_KEYS
-    'API_KEY' => 'default-key',
+    // Default key for protected endpoints that don't have a specific key in CUSTOM_ENDPOINT_KEYS
+    'GENERAL_API_KEY' => 'default-key',
 
-    // If you want restrict access to protected endpoints to specific clients, you can define custom keys for each endpoint
-    'ENDPOINT_KEYS' => [
-    // For subfolder endpoints, use the relative path ('subfolder/endpoint')
-    // 'subfolder/endpoint'    => 'example-key',
+    // Per-endpoint keys. For subfolder endpoints, use the relative path ('subfolder/endpoint')
+    'CUSTOM_ENDPOINT_KEYS' => [
+        // 'subfolder/endpoint' => 'example-key',
+    ],
+
+    // Default CORS origins applied to every endpoint
+    'GENERAL_ALLOWED_ORIGINS' => [
+        'https://example.com',
+    ],
+
+    // Per-endpoint CORS origins. Same path format as CUSTOM_ENDPOINT_KEYS.
+    // When an endpoint is listed here, these origins replace GENERAL_ALLOWED_ORIGINS for it.
+    'CUSTOM_ENDPOINT_ORIGINS' => [
+        // 'subfolder/endpoint' => ['https://app.example.com'],
     ],
 
     'DB_HOST' => '127.0.0.1',
@@ -48,7 +58,22 @@ return [
 ];
 ```
 
-`API_KEY` is the fallback key for all protected endpoints. Use `ENDPOINT_KEYS` to assign a different key to a specific endpoint — for subfolder endpoints, use the relative path as the key.
+### API keys
+
+`GENERAL_API_KEY` is the fallback key for all protected endpoints. Use `CUSTOM_ENDPOINT_KEYS` to assign a different key to a specific endpoint — for subfolder endpoints, use the relative path as the key.
+
+> ⚠️ The API key travels in the `X-Api-Key` header on every request. Use it only for server-to-server calls over HTTPS. Never embed it in frontend code, where it would be publicly visible.
+
+### CORS (allowed origins)
+
+Cross-origin access mirrors the API-key model:
+
+- `GENERAL_ALLOWED_ORIGINS` — the default list of origins allowed to call any endpoint from a browser.
+- `CUSTOM_ENDPOINT_ORIGINS` — overrides the default for a specific endpoint, keyed by the same relative path used in `CUSTOM_ENDPOINT_KEYS`.
+
+Origins must be exact (scheme + host, no trailing slash), e.g. `https://example.com`. When a request's `Origin` is in the resolved list, it is reflected back in `Access-Control-Allow-Origin` (with `Vary: Origin`). An empty list sends no CORS header — the most restrictive setting; same-origin requests still work. Use `'*'` as the only element to allow any origin (not recommended for protected endpoints).
+
+Resolution order for a given endpoint: `CUSTOM_ENDPOINT_ORIGINS[path]` if present, otherwise `GENERAL_ALLOWED_ORIGINS`.
 
 ## How routing works
 
@@ -102,7 +127,7 @@ Response::success(['visits' => 1024]);
 To assign a dedicated key, add it to `config.php`:
 
 ```php
-'ENDPOINT_KEYS' => [
+'CUSTOM_ENDPOINT_KEYS' => [
     'endpoint' => 'custom-key',
 ],
 ```

package/nginx.conf

@@ -0,0 +1,69 @@
+# Redirect all HTTP traffic to HTTPS
+server {
+    listen 80;
+    server_name _;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl;
+    server_name _;
+
+    # SSL certificate — replace with your own paths.
+    # Let's Encrypt default shown below; adjust the domain.
+    ssl_certificate     /etc/letsencrypt/live/your-domain/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/your-domain/privkey.pem;
+
+    # Hide the nginx version from response headers
+    server_tokens off;
+
+    # Force HTTPS on future requests (applies site-wide, including /api)
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+
+    root /var/www/html/out;
+    index index.html;
+
+    # Disable directory listing
+    autoindex off;
+
+    error_page 403 404 /404.html;
+    location = /404.html {
+        internal;
+    }
+
+    # Never expose the backend source directory
+    location ^~ /backend/ {
+        return 404;
+    }
+
+    # Block server config files anywhere in the tree (.htaccess, web.config).
+    # return 404 is served internally as /404.html via error_page above.
+    location ~* (^|/)(\.htaccess|web\.config)$ {
+        return 404;
+    }
+
+    # Block dotfiles (.git, .env, etc.)
+    location ~ /\. {
+        return 404;
+    }
+
+    # Route all /api/ requests to the PHP front controller.
+    # Security headers for API responses are set by the front controller (PHP).
+    location ^~ /api/ {
+        try_files $uri =404;
+        fastcgi_pass unix:/run/php-fpm/php-fpm.sock;
+        fastcgi_param SCRIPT_FILENAME $document_root/backend/_core/index.php;
+        include fastcgi_params;
+    }
+
+    # Serve static files, fall back to the 404 page.
+    # A location with add_header does not inherit server-level headers,
+    # so Strict-Transport-Security is repeated here.
+    location / {
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+        try_files $uri $uri/ /404.html;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-berna-stencil",
-  "version": "2.4.2",
+  "version": "2.5.0",
   "description": "Eleventy boilerplate with per-page SCSS/JS pipeline, esbuild bundling, multi-framework CSS support and a built-in page management CLI",
   "keywords": [],
   "author": "Michele Garofalo",
@@ -23,6 +23,7 @@
     "_tools/",
     ".eleventy.js",
     ".eleventyignore",
+    "nginx.conf",
     ".gitignore",
     "tsconfig.json",
     "LICENSE",

package/src/backend/_core/index.php

@@ -87,14 +87,34 @@ if (!$endpointFile) {
     exit;
 }
 
+$base         = $isProtected ? $baseProtected : $basePublic;
+$base         = str_replace('\\', '/', $base);
+$endpointPath = str_replace('\\', '/', $endpointFile);
+$endpointPath = preg_replace('#\.php$#', '', str_replace($base, '', $endpointPath));
+
 // =====================================================
 // 3. HEADERS AND CORS (Only if the endpoint exists)
 // =====================================================
 
 header('Content-Type: application/json; charset=UTF-8');
+header('X-Content-Type-Options: nosniff');
+header('X-Frame-Options: DENY');
+header('Referrer-Policy: strict-origin-when-cross-origin');
 header('Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE, OPTIONS');
 header('Access-Control-Allow-Headers: Content-Type, X-Api-Key');
-header('Access-Control-Allow-Origin: *');
+
+$originsForEndpoint = $config['CUSTOM_ENDPOINT_ORIGINS'][$endpointPath]
+    ?? $config['GENERAL_ALLOWED_ORIGINS']
+    ?? [];
+
+$origin = $_SERVER['HTTP_ORIGIN'] ?? '';
+
+if ($origin !== '' && in_array($origin, $originsForEndpoint, true)) {
+    header('Access-Control-Allow-Origin: ' . $origin);
+    header('Vary: Origin');
+} elseif (in_array('*', $originsForEndpoint, true)) {
+    header('Access-Control-Allow-Origin: *');
+}
 
 if ($method === 'OPTIONS') {
     http_response_code(204);
@@ -109,11 +129,8 @@ RateLimiter::check($_SERVER['REMOTE_ADDR'] ?? '', 60, 60);
 // =====================================================
 
 if ($isProtected) {
-    $relPath   = str_replace($baseProtected, '', $endpointFile);
-    $relPath   = str_replace('.php', '', str_replace('\\', '/', $relPath));
-
-    $validKey  = $config['ENDPOINT_KEYS'][$relPath] ?? $config['API_KEY'] ?? '';
-    $apiKey    = $_SERVER['HTTP_X_API_KEY'] ?? '';
+    $validKey = $config['CUSTOM_ENDPOINT_KEYS'][$endpointPath] ?? $config['GENERAL_API_KEY'] ?? '';
+    $apiKey   = $_SERVER['HTTP_X_API_KEY'] ?? '';
 
     if ($validKey === '' || !hash_equals($validKey, $apiKey)) {
         Response::error('Unauthorized. X_API_KEY is incorrect or missing', 401);

package/src/backend/config.example.php

@@ -2,13 +2,22 @@
 declare(strict_types=1);
 
 return [
-    // Default key for protected endpoints that don't have a specific key in ENDPOINT_KEYS
-    'API_KEY' => 'DEFAULT_KEY',
+    // Default key for protected endpoints that don't have a specific key in CUSTOM_ENDPOINT_KEYS
+    'GENERAL_API_KEY' => 'DEFAULT_KEY',
 
     // If you want restrict access to protected endpoints to specific clients, you can define custom keys for each endpoint
     // For subfolder endpoints, use the relative path ('subfolder/endpoint')
-    'ENDPOINT_KEYS' => [
-    'subfolder/example-protected'    => 'custom-key',
+    'CUSTOM_ENDPOINT_KEYS' => [
+        'subfolder/example-protected'    => 'custom-key',
+    ],
+
+    'GENERAL_ALLOWED_ORIGINS' => [
+        '*',
+        // 'https://example.com',
+    ],
+
+    'CUSTOM_ENDPOINT_ORIGINS' => [
+        'subfolder/example-protected'    => ['https://app.example.com'],
     ],
 
     // Database configuration