mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 5.5
0986957e52
proxy_hide_header is replaced, not merged, by a location that sets its own, so upstream_strips.conf.j2 only takes effect where a location includes it. The health locations of web-app-prometheus (/healthz/ready, /_live_probe), which every standard vhost includes, and the extra locations of web-app-bluesky (/config, /ipcc) and web-app-opentalk (/v1/, /signaling, /livekit) proxied without it, so X-Powered-By and the upstream's Strict-Transport-Security leaked on those paths. All seven locations now include the strips. A new lint checks every role template without a server block, i.e. every fragment the front proxy renders into a vhost, and fails on a proxying location that lacks them. Templates with their own server block are app-internal nginx configs behind such a location and stay out of scope. Closes #1124 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
46 lines
1.8 KiB
Django/Jinja
46 lines
1.8 KiB
Django/Jinja
# Routes additional OpenTalk endpoints alongside the web frontend.
|
|
# The default location (handled by the front proxy) forwards to the
|
|
# frontend container at {{ OPENTALK_FRONTEND_HTTP_PORT }}; the controller
|
|
# REST API and LiveKit signalling need explicit upstream rules.
|
|
|
|
location /v1/ {
|
|
proxy_pass http://127.0.0.1:{{ OPENTALK_CTRL_HTTP_PORT }};
|
|
{% include 'roles/sys-svc-proxy/templates/headers/upstream_strips.conf.j2' %}
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_buffering off;
|
|
proxy_request_buffering off;
|
|
client_max_body_size 0;
|
|
}
|
|
|
|
location /signaling {
|
|
proxy_pass http://127.0.0.1:{{ OPENTALK_CTRL_HTTP_PORT }};
|
|
{% include 'roles/sys-svc-proxy/templates/headers/upstream_strips.conf.j2' %}
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_read_timeout 86400;
|
|
proxy_buffering off;
|
|
}
|
|
|
|
location /livekit {
|
|
proxy_pass http://127.0.0.1:{{ OPENTALK_LIVEKIT_HTTP_PORT }};
|
|
{% include 'roles/sys-svc-proxy/templates/headers/upstream_strips.conf.j2' %}
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_read_timeout 86400;
|
|
proxy_buffering off;
|
|
}
|