mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbach
211d98aa88
b8759a363e closed this for html.conf.j2 and its message said 'every proxy
location', so the class read as done. Three proxying snippets never got
it: ws, upload and media.
They are not covered by inheritance. nginx inherits proxy_set_header as
an array, so a location declaring any of its own discards every one from
the enclosing block, and proxy_pass_request_headers defaults to on. A
grep for the strip found exactly one include site before this commit,
which means there was nothing above those locations to inherit either.
So every websocket, upload and image location forwarded whatever
X-Forwarded-User the client sent, to applications that authenticate by
believing that header. Reached through ws_generic (mastodon, espocrm,
odoo), nextcloud's signaling and whiteboard, peertube's websocket and
tracker, and collabora's /cool/.
The lint asks the file whether it proxies rather than keeping a list of
snippet names. It grants no exemption for an SSO branch: html.conf.j2
carries both, and an exemption keyed on the SSO reference would keep it
green after the strip was deleted from the other branch.
14 lines
656 B
Django/Jinja
14 lines
656 B
Django/Jinja
location ~* \.(jpg|jpeg|png|gif|webp|ico|svg)$ {
|
|
expires 30d;
|
|
add_header Cache-Control "public, max-age=2592000, immutable";
|
|
|
|
{{ lookup('proxy_pass', application_id, proxy_service_key | default(application_id | get_entity_name), 'http', tail='plain', local_port=http_port, internal_port=proxy_internal_port | default('')) }}
|
|
proxy_cache imgcache;
|
|
proxy_cache_valid 200 302 60m;
|
|
proxy_cache_valid 404 1m;
|
|
add_header X-Proxy-Cache $upstream_cache_status;
|
|
|
|
{% include 'roles/sys-svc-proxy/templates/headers/identity_request_strips.conf.j2' %}
|
|
|
|
{% include 'roles/sys-svc-proxy/templates/headers/upstream_strips.conf.j2' %}
|
|
} |