mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbach
f5272fa85f
Baserow's image mounts the MCP app on the ASGI root unconditionally, so
mcp.enabled only decides whether an endpoint record exists. The
application's own vhost kept routing /mcp/*: switched off it answered
401 Endpoint not found., and a refused credential is still a surface.
Switched on it is worse - the adapter narrows fourteen upstream tools to
four, and the publicly routed native path reaches all fourteen for
anyone holding the endpoint key. web-app-homeassistant had the same
shape, an exposure: internal surface reachable publicly. Both now 404
there and stay reachable on the container network.
The public surfaces get the edge limits the contract already declared.
Zones are written per role by the role that owns them, in the shape
web-app-prometheus uses, because one round-scoped file would drop another
application's zones on the next deploy. The rate is concurrent_requests
per second rather than an eighth limit key: a client allowed N in flight,
each bounded by timeout_seconds, cannot sustain more unless every call
returns instantly. A refusal is 429, not nginx's 503, because a client
that should back off must not read it as an outage. stream_seconds
finally binds something - the adapter holds no stream, the proxy does.
The shared location snippet's three timeouts become parameters defaulting
to the 900s they hard-coded, so no existing vhost changes.
Found by the disabled-state assertion 7d8e7e87ff added, which had never
run: its helper was never staged, so the two defects hid each other.
62 lines
2.0 KiB
Django/Jinja
62 lines
2.0 KiB
Django/Jinja
{% set application_id = front_proxy_application_id | default(application_id) %}
|
|
{% set domain = front_proxy_domain | default(domain) %}
|
|
server
|
|
{
|
|
server_name {{ domain }};
|
|
{% include 'roles/sys-svc-proxy/templates/headers/buffers.conf.j2' %}
|
|
|
|
{% if lookup('sso', application_id, 'is_proxy_gated') %}
|
|
{% include 'roles/web-app-keycloak/templates/sso_proxy/endpoint.conf.j2'%}
|
|
{% endif %}
|
|
|
|
{% include 'roles/sys-front-inj-all/templates/server.conf.j2'%}
|
|
|
|
{% if webserver_extra_configuration is defined %}
|
|
{{ webserver_extra_configuration }}
|
|
{% endif %}
|
|
|
|
{% include 'roles/sys-front-tls/templates/nginx_ssl_header.j2' %}
|
|
|
|
{% if lookup('sso', application_id, 'is_proxy_gated') %}
|
|
{% set acl = lookup('sso', application_id, 'oauth2_acl') %}
|
|
|
|
{% if acl.blacklist is defined %}
|
|
{% set sso_proxy_enabled = false %}
|
|
{% set location = "/" %}
|
|
{% include 'roles/sys-svc-proxy/templates/location/html.conf.j2' %}
|
|
|
|
{% for loc in acl.blacklist %}
|
|
{% set sso_proxy_enabled = true %}
|
|
{% set location = loc %}
|
|
{% include 'roles/sys-svc-proxy/templates/location/html.conf.j2' %}
|
|
{% endfor %}
|
|
|
|
{% elif acl.whitelist is defined %}
|
|
{% set sso_proxy_enabled = true %}
|
|
{% set location = "/" %}
|
|
{% include 'roles/sys-svc-proxy/templates/location/html.conf.j2' %}
|
|
|
|
{% for loc in acl.whitelist %}
|
|
{% set sso_proxy_enabled = false %}
|
|
{% set location = loc %}
|
|
{% include 'roles/sys-svc-proxy/templates/location/html.conf.j2' %}
|
|
{% endfor %}
|
|
|
|
{% else %}
|
|
{% set sso_proxy_enabled = true %}
|
|
{% set location = "/" %}
|
|
{% include 'roles/sys-svc-proxy/templates/location/html.conf.j2' %}
|
|
{% endif %}
|
|
|
|
{% else %}
|
|
{% set sso_proxy_enabled = false %}
|
|
{% set location = "/" %}
|
|
{% include 'roles/sys-svc-proxy/templates/location/html.conf.j2' %}
|
|
{% endif %}
|
|
|
|
{% include 'roles/web-app-prometheus/templates/nginx/locations.conf.j2' %}
|
|
|
|
{% include 'roles/sys-svc-proxy/templates/mcp/vhost.conf.j2' %}
|
|
|
|
}
|