mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbach
f5272fa85f
Baserow's image mounts the MCP app on the ASGI root unconditionally, so
mcp.enabled only decides whether an endpoint record exists. The
application's own vhost kept routing /mcp/*: switched off it answered
401 Endpoint not found., and a refused credential is still a surface.
Switched on it is worse - the adapter narrows fourteen upstream tools to
four, and the publicly routed native path reaches all fourteen for
anyone holding the endpoint key. web-app-homeassistant had the same
shape, an exposure: internal surface reachable publicly. Both now 404
there and stay reachable on the container network.
The public surfaces get the edge limits the contract already declared.
Zones are written per role by the role that owns them, in the shape
web-app-prometheus uses, because one round-scoped file would drop another
application's zones on the next deploy. The rate is concurrent_requests
per second rather than an eighth limit key: a client allowed N in flight,
each bounded by timeout_seconds, cannot sustain more unless every call
returns instantly. A refusal is 429, not nginx's 503, because a client
that should back off must not read it as an outage. stream_seconds
finally binds something - the adapter holds no stream, the proxy does.
The shared location snippet's three timeouts become parameters defaulting
to the 900s they hard-coded, so no existing vhost changes.
Found by the disabled-state assertion 7d8e7e87ff added, which had never
run: its helper was never staged, so the two defects hid each other.
NGINX vHost Templates: Basic vs. WebSocket (ws_generic)
This directory provides two NGINX server templates for reverse proxying Dockerized applications behind NGINX:
basic.conf.j2ws_generic.conf.j2
When to Use Which Template?
1. basic.conf.j2
Use this template for standard HTTP/S applications.
It is optimized for typical web applications (e.g., static sites, PHP, Node.js, Django, etc.) that do not require persistent, bidirectional WebSocket connections.
-
Features:
- HTTP/2 support, TLS/SSL integration
- Reverse proxy with buffering enabled (
proxy_buffering on) - Allows advanced content filtering (e.g., via Lua body/headers)
- Suitable for most REST APIs, web frontends, and admin panels
-
Pros:
- Enables HTML/body manipulation (for injecting snippets, analytics, CSP, etc.)
- Optimized for efficient caching and GZIP compression
- Good default for "normal" web traffic
-
Cons:
- Not suitable for WebSocket endpoints (buffering can break WS)
- Slightly more latency for streaming data due to buffering
2. ws_generic.conf.j2
Use this template for applications requiring WebSocket support.
Designed for services (e.g., chat servers, real-time dashboards) needing fast, persistent connections using the WebSocket protocol.
-
Features:
- WebSocket-aware:
proxy_buffering off, special upgrade headers - Supports standard HTTP/S traffic alongside WebSockets
- Proper handling of connection upgrades and protocol switching
- WebSocket-aware:
-
Pros:
- Required for all WebSocket endpoints
- Allows instant, low-latency bidirectional traffic
- Prevents data loss or connection drops due to proxy buffering
-
Cons:
- Disables body/content filtering and response manipulation
- No buffering means less effective for caching/optimization
- Not suitable for scenarios requiring Lua/JS content injection
Summary Table
| Use Case | Template | Buffering | WebSocket? | Can Filter Content? |
|---|---|---|---|---|
| Static/Classic Website | basic.conf.j2 |
On | No | Yes |
| REST API | basic.conf.j2 |
On | No | Yes |
| Real-Time Chat/App | ws_generic.conf.j2 |
Off | Yes | No |
| Dashboard w/Live Data | ws_generic.conf.j2 |
Off | Yes | No |
| Needs HTML Injection | basic.conf.j2 |
On | No | Yes |
Good to Know
- Never enable buffering for true WebSocket connections!
Useproxy_buffering off;(as inws_generic.conf.j2) or connections may fail. - For most classic web applications, use the basic template.
- For apps where you want to inject or modify HTML (e.g., analytics scripts), only the basic template supports this.
Author & Project
By Kevin Veen-Birkenbach
Part of the Infinito.Nexus Project
Licensed under the Infinito.Nexus Community License (Non-Commercial)