mrleo1nidandClaude Opus 5.5
38edcd3e0e
ci / docker (образы собираются — их сервер собирает сам при обновлении) (apps/web/Dockerfile, web, ) (push) Canceled after 0s
ci / docker (образы собираются — их сервер собирает сам при обновлении) (services/api/Dockerfile, api, api) (push) Canceled after 0s
ci / docker (образы собираются — их сервер собирает сам при обновлении) (services/api/Dockerfile, storage-agent, storage-agent) (push) Canceled after 0s
ci / docker (образы собираются — их сервер собирает сам при обновлении) (services/recommender/Dockerfile, recommender, ) (push) Canceled after 0s
ci / mobile (Metro-бандл Android) (push) Canceled after 0s
ci / contract (сгенерированный код совпадает с openapi.yaml) (push) Canceled after 0s
ci / api (push) Canceled after 0s
ci / recommender (push) Canceled after 0s
ci / ts (packages + web) (push) Canceled after 0s
Add an install step for mounting the music disk via fstab and wire it into the stack: LIBRARY_HOST in .env points at the host folder, compose mounts it as /library-host (read-only for api, nginx and analyzer; writable only for storage-agent), nginx serves it through X-Accel, and install.sh validates the path and records it in .env. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
69 lines
2.7 KiB
Plaintext
69 lines
2.7 KiB
Plaintext
# Шаблон обрабатывается envsubst при старте контейнера nginx (переменные: API_UPSTREAM).
|
|
# HTTPS терминирует внешний прокси: Caddy из compose.tls.yaml или ваш собственный — см. docs/install-guide.md.
|
|
|
|
# За внешним прокси (Caddy, Traefik, ...) сохраняем исходную схему и IP клиента.
|
|
map $http_x_forwarded_proto $pipu_scheme {
|
|
default $http_x_forwarded_proto;
|
|
'' $scheme;
|
|
}
|
|
|
|
upstream pipu_api {
|
|
server ${API_UPSTREAM};
|
|
keepalive 16;
|
|
}
|
|
|
|
server {
|
|
listen 80;
|
|
server_name _;
|
|
|
|
# Доверяем X-Forwarded-For только от частных сетей (docker, LAN), где стоит прокси.
|
|
set_real_ip_from 10.0.0.0/8;
|
|
set_real_ip_from 172.16.0.0/12;
|
|
set_real_ip_from 192.168.0.0/16;
|
|
real_ip_header X-Forwarded-For;
|
|
real_ip_recursive on;
|
|
|
|
root /usr/share/nginx/html;
|
|
client_max_body_size 16m;
|
|
|
|
include /etc/nginx/snippets/security-headers.conf;
|
|
|
|
gzip on;
|
|
gzip_types text/css application/javascript application/json image/svg+xml;
|
|
|
|
location /api/ {
|
|
proxy_pass http://pipu_api;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Connection "";
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $pipu_scheme;
|
|
# api берёт IP клиента только из X-Real-IP; остальные заголовки клиент может подделать
|
|
proxy_set_header True-Client-IP "";
|
|
}
|
|
|
|
location = /healthz { proxy_pass http://pipu_api; }
|
|
location = /readyz { proxy_pass http://pipu_api; }
|
|
|
|
# Аудио и обложки отдаёт nginx по заголовку X-Accel-Redirect от api (docs/playback.md).
|
|
location /_internal/library/ { internal; alias /library/; sendfile on; aio threads; }
|
|
location /_internal/library-host/ { internal; alias /library-host/; sendfile on; aio threads; }
|
|
location /_internal/cache/ { internal; alias /cache/transcode/; sendfile on; }
|
|
location /_internal/covers/ { internal; alias /cache/covers/; expires 30d; }
|
|
location /_internal/uploads/ { internal; alias /uploads/; sendfile on; }
|
|
|
|
location /assets/ {
|
|
expires 1y;
|
|
include /etc/nginx/snippets/security-headers.conf;
|
|
add_header Cache-Control "public, immutable";
|
|
try_files $uri =404;
|
|
}
|
|
|
|
location / {
|
|
include /etc/nginx/snippets/security-headers.conf;
|
|
add_header Cache-Control "no-cache";
|
|
try_files $uri $uri/ /index.html;
|
|
}
|
|
}
|