From 94a0bac9f44270d138749e9efa66b910987c816e Mon Sep 17 00:00:00 2001
From: mk <mk@mk.fo>
Date: Tue, 28 Jul 2026 06:04:57 +0300
Subject: [PATCH] =?UTF-8?q?hardening(angie):=20resolve=20mime.types=20from?=
 =?UTF-8?q?=20whichever=20path=20the=20package=20ships=20(angie-bin=3D/etc?=
 =?UTF-8?q?/angie,=20Arch=20source=3D/etc/nginx=20via=20mailcap=20dep)=20?=
 =?UTF-8?q?=E2=80=94=20fixes=20'angie=20-t'=20'open()=20mime.types=20faile?=
 =?UTF-8?q?d'=20on=20source=20path;=20fallback=20ships=20a=20minimal=20mim?=
 =?UTF-8?q?e.types;=20ensure=20modules/=20include=20dirs=20exist=20before?=
 =?UTF-8?q?=20glob?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 modules/50-hardening.sh | 31 ++++++++++++++++++++++++++++++-
 1 file changed, 30 insertions(+), 1 deletion(-)

diff --git a/modules/50-hardening.sh b/modules/50-hardening.sh
index 38d196c..382103d 100755
--- a/modules/50-hardening.sh
+++ b/modules/50-hardening.sh
@@ -227,6 +227,17 @@ _h_angie_config() {
   [[ -z "$angie_pid" ]]  && angie_pid=/run/angie.pid
   [[ -z "$angie_err" ]]  && angie_err=/var/log/angie/error.log
 
+  # locate mime.types: angie-bin/Debian ship /etc/angie/mime.types; the Arch source
+  # 'angie' package instead pulls it from the 'mailcap' dep at /etc/nginx/mime.types
+  # (and deletes its own). Pick whichever exists so 'angie -t' doesn't fail on include.
+  local angie_mime=""
+  for m in "$d/mime.types" /etc/nginx/mime.types /etc/mime.types; do
+    [[ -f "$m" ]] && { angie_mime="$m"; break; }
+  done
+  [[ -z "$angie_mime" ]] && { warn "no mime.types found; installing a minimal one"; _angie_install_mime "$d/mime.types"; angie_mime="$d/mime.types"; }
+  # the modules/ include dir must exist or the glob fails the config test
+  sudo_ install -d -m 0755 "$d/modules" "$d/modules/http"
+
   # backup the original once
   if [[ -f "$oldcfg" && ! -f "$oldcfg.orig.bootstrap" ]]; then
     sudo_ cp -a "$oldcfg" "$oldcfg.orig.bootstrap"
@@ -255,7 +266,7 @@ events {
 }
 
 http {
-    include       /etc/angie/mime.types;
+    include       $angie_mime;
     default_type  application/octet-stream;
 
     log_format main '\$remote_addr - \$remote_user [\$time_local] "\$request" '
@@ -364,6 +375,24 @@ EOF
   # ufw already opened 80/443 in _h_ufw
 }
 
+_angie_install_mime() { # dest — write a minimal mime.types if none exists on the host
+  sudo_ tee "$1" >/dev/null <<'EOF'
+types {
+    text/html          html htm shtml;
+    text/css           css;
+    text/xml           xml;
+    image/gif          gif;
+    image/jpeg         jpeg jpg;
+    image/png          png;
+    image/svg+xml      svg svgz;
+    application/javascript      js;
+    application/json   json;
+    application/pdf    pdf;
+    application/zip    zip;
+    application/octet-stream   bin exe dll so deb dmg iso img;
+}
+EOF
+}
 _angie_helpers() {
   sudo_ tee /usr/local/bin/angie-enable >/dev/null <<'EOF'
 #!/usr/bin/env bash