From 26185978acfbba1de866dd6ee1f1f76c9330d6a9 Mon Sep 17 00:00:00 2001
From: mk <mk@mk.fo>
Date: Tue, 28 Jul 2026 05:59:08 +0300
Subject: [PATCH] =?UTF-8?q?hardening(angie):=20source-angie=20bridge=20?=
 =?UTF-8?q?=E2=80=94=20symlink=20/etc/nginx/nginx.conf=20->=20/etc/angie/a?=
 =?UTF-8?q?ngie.conf=20so=20the=20=5Fon/targets=20layout=20actually=20load?=
 =?UTF-8?q?s=20under=20the=20source=20AUR=20package's=20'/usr/bin/nginx'?=
 =?UTF-8?q?=20service=20(angie-bin/Debian=20already=20read=20/etc/angie=20?=
 =?UTF-8?q?directly);=20backup=20original=20once?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 modules/50-hardening.sh | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/modules/50-hardening.sh b/modules/50-hardening.sh
index aa45be7..38d196c 100755
--- a/modules/50-hardening.sh
+++ b/modules/50-hardening.sh
@@ -327,7 +327,25 @@ EOF
   # ── angie-enable / angie-disable helpers ──
   _angie_helpers
 
-  # validate + (best-effort) reload
+  # ── source-angie bridge: point /etc/nginx/nginx.conf at our /etc/angie layout ─
+  # The source AUR 'angie' package compiles --conf-path=/etc/nginx/nginx.conf and
+  # its service runs '/usr/bin/nginx' with no -c flag, so it ignores /etc/angie.
+  # When that path is where angie actually reads, back it up once and symlink it to
+  # our managed angie.conf so the _on/targetsmodules layout takes effect. The
+  # angie-bin / Debian packages already read /etc/angie/angie.conf directly.
+  if [[ -f /etc/nginx/nginx.conf && -f "$d/angie.conf" ]]; then
+    local nginxconf=/etc/nginx/nginx.conf
+    if [[ "$(readlink -f "$nginxconf" 2>/dev/null)" == "$d/angie.conf" ]]; then
+      ok "$nginxconf already symlinks to $d/angie.conf"
+    else
+      if [[ ! -f "${nginxconf}.orig.bootstrap" && ! -L "$nginxconf" ]]; then
+        sudo_ cp -a "$nginxconf" "${nginxconf}.orig.bootstrap"
+      fi
+      sudo_ ln -sfn "$d/angie.conf" "$nginxconf"
+      ok "symlinked $nginxconf -> $d/angie.conf (source-angie bridge); backup at ${nginxconf}.orig.bootstrap"
+    fi
+  fi
+
   if sudo_ angie -t 2>&1; then
     ok "angie config valid"
     if command -v systemctl >/dev/null 2>&1 && systemctl is-active angie >/dev/null 2>&1; then