mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Fable 5
30afef6bbe
resource_filter now falls back service_name -> entity_name -> hard default, so entity-level limits keep applying to per-service compose entries. Compose service names drop the entity prefix (kix, jitsi, zammad, bluesky); the docker container_name keeps it via compose_only. A new lint forbids '<entity>-'-prefixed service names. Service names and internal ports are declared once: vars/main.yml holds <ROLE>_<SERVICE>_SERVICE constants (container names derived via entity_name), meta/services.yml declares ports.internal consumed through config lookups. sso-proxy upstreams stack-qualify the origin host in swarm because short aliases are ambiguous on shared overlays. Stale proxy.service_key entries fixed for erpnext/shopware/nextcloud. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
40 lines
1.2 KiB
Django/Jinja
40 lines
1.2 KiB
Django/Jinja
server_tokens off;
|
|
|
|
map $http_sec_websocket_key $http_upgrade {
|
|
"" "";
|
|
default "websocket";
|
|
}
|
|
|
|
map $http_sec_websocket_key $connection_upgrade {
|
|
"" $http_connection;
|
|
default "upgrade";
|
|
}
|
|
|
|
{{ NETWORK_DOCKER_DNS_NGINX_DIRECTIVE }}
|
|
|
|
server {
|
|
listen 80;
|
|
server_name _;
|
|
|
|
# Exception: strip client-supplied Remote-User; otherwise a client could spoof it past the oauth2-proxy hop that sets it below.
|
|
proxy_set_header Remote-User "";
|
|
|
|
client_max_body_size 64m;
|
|
proxy_read_timeout 300s;
|
|
proxy_send_timeout 300s;
|
|
|
|
location / {
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Forwarded-User $http_x_forwarded_user;
|
|
proxy_set_header Remote-User $http_x_forwarded_user;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
proxy_http_version 1.1;
|
|
set $upstream_kix_frontend http://{{ KIX_FRONTEND_SERVICE }}:{{ KIX_FRONTEND_INTERNAL_PORT }};
|
|
proxy_pass $upstream_kix_frontend;
|
|
}
|
|
}
|