0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-06 02:54:26 +00:00

Files

T

History

kevinveenbirkenbachandClaude Opus 5.5 8d6040948c fix(sys-svc-webserver-core): match token routes on the decoded path

The access-log map read $request_uri, which keeps percent-encoding and
repeated slashes. A request such as /%70assword/reset/<token>,
/password%2Freset/<token> or //password//reset/<token> missed the
token-route expression, fell through to the plain-path branch and was
logged with the token in plain text, while the backend still decoded it
to its reset handler.

The map now reads $uri: decoded, slash-merged (merge_slashes is not
overridden anywhere) and without the query string, so the existing
expressions match every spelling of a token route. Trade-off: after an
internal redirect the log shows the internal URI; with the generic
vhost's error_page (ws_generic.conf.j2) a 5xx line now carries
/500.html instead of the client's path, with the status unchanged.
Nothing in the repository parses the proxy access log.

The unit test resolves the map against the variable it reads, modelling
$uri as nginx builds it, and adds the three encoded spellings above.
Negative control: with the map back on $request_uri, exactly those three
cases fail (3 failed, 8 passed).

Reported by CodeRabbit on #1322.

Part of #1192

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-31 12:46:31 +01:00

README.md

Webserver

Description

This Ansible role installs and configures NGINX as a core HTTP/stream server on Arch Linux systems. It provides:

HTTP serving with MIME types, gzip compression, caching, and custom NGINX.conf templating.
TCP/UDP stream support via the NGINX Streams module.
Directory management for configuration, sites-available/enabled, cache, and data.
Debugging helpers: log formats and instructions for general and detailed troubleshooting.

Overview

This role installs and configures Nginx HTTP and stream modules with performance-tuned defaults.

Cosmos

The diagram places Webserver in the Infinito.Nexus cosmos: the components it deploys (capabilities), the central services it consumes (dependencies), and its outward reach (federation and bridged external networks).

flowchart LR
    subgraph role [sys-svc-webserver-core 💻]
        svc_svc_webserver_core["svc-webserver-core"]
    end

Solid 1:1 edges are fixed relationships; dashed 0..1 edges are conditional (enabled only in matching deployments); red 0..0 edges are turned off in this role. Node markers show the role's deploy modes (💻 host, 🐳 compose, 🐝 swarm); ❌ marks a service that is explicitly turned off, and ⚙️ an Ansible role dependency declared in meta/main.yml.

Features

Package installation of NGINX and NGINX-mod-stream.
Idempotent setup: tasks run only once per host.
Configurable reset and cleanup modes to purge and recreate directories.
Custom NGINX.conf template with sensible defaults for performance and security.
Stream proxy support: includes stream block for TCP/UDP proxies.
Cache directory management: cleanup and recreation based on MODE_CLEANUP.

Debugging Tips

General logs: journalctl -f -u NGINX
Filter by host: journalctl -u NGINX -f | grep "{{ inventory_hostname }}"
Enable detailed format: set MODE_DEBUG: true and reload NGINX.
Redacted request path: both access log formats write the path without query string, Referer or basic-auth user. Path segments after a password-reset, e-mail confirmation, e-mail login or account activation route (e.g. /password/reset/, /confirm-email/) are written as [redacted]; extend the $infinito_access_log_path map in nginx.conf.j2 for further token routes.

Credits

Implemented by Kevin Veen-Birkenbach. Part of the Infinito.Nexus Project and maintained by Kevin Veen-Birkenbach. Licensed under the Infinito.Nexus Community License (Non-Commercial).