Serve linkding's favicons and preview images

linkding stores them in data/favicons and data/previews and upstream maps both
under /static next to the collected assets, with a sandbox CSP. The nginx site
only aliased the collected assets, so every downloaded image answered 404; the
update rewrites that block even without a new release.

ct/linkding.sh

@@ -32,6 +32,16 @@ function update_script() {
     exit
   fi
 
+  if grep -q 'alias /opt/linkding/static/;' /etc/nginx/sites-available/linkding 2>/dev/null; then
+    msg_info "Serving Favicons and Preview Images"
+    sed -i \
+      -e 's|location /static/ {|location ~ ^/static/(.*)$ {|' \
+      -e 's|alias /opt/linkding/static/;|root /opt/linkding;\n        try_files /static/$1 /data/favicons/$1 /data/previews/$1 =404;\n        add_header Content-Security-Policy "sandbox";|' \
+      /etc/nginx/sites-available/linkding
+    $STD systemctl reload nginx
+    msg_ok "Serving Favicons and Preview Images"
+  fi
+
   if check_for_gh_release "linkding" "sissbruecker/linkding"; then
     msg_info "Stopping Services"
     systemctl stop nginx linkding linkding-tasks

install/checkmate-install.sh

@@ -21,7 +21,7 @@ $STD apt install -y \
 msg_ok "Installed Dependencies"
 
 MONGO_VERSION="8.0" setup_mongodb
-NODE_VERSION="24" setup_nodejs
+NODE_VERSION="22" setup_nodejs
 fetch_and_deploy_gh_release "checkmate" "bluewave-labs/Checkmate" "tarball"
 
 msg_info "Configuring Checkmate"

install/linkding-install.sh

@@ -101,8 +101,10 @@ server {
 
     client_max_body_size 20M;
 
-    location /static/ {
-        alias /opt/linkding/static/;
+    location ~ ^/static/(.*)$ {
+        root /opt/linkding;
+        try_files /static/$1 /data/favicons/$1 /data/previews/$1 =404;
+        add_header Content-Security-Policy "sandbox";
         expires 30d;
     }