mrleo1nid
82bf015283
ci / module boundaries / boundaries (push) Successful in 6s
ci / contract / contract (сгенерированный код совпадает с openapi.yaml) (push) Successful in 2m1s
ci / ts / ts (packages + web) (push) Failing after 5m13s
ci / api / api (push) Successful in 41s
ci / db / db (push) Failing after 1m33s
ci / mobile / mobile (Metro-бандл Android) (push) Successful in 2m25s
ci / docker / docker (образы собираются — их сервер собирает сам при обновлении) (push) Successful in 2m19s
70 lines
2.8 KiB
Plaintext
70 lines
2.8 KiB
Plaintext
# Шаблон обрабатывается envsubst при старте контейнера nginx (переменные: API_UPSTREAM).
|
|
# HTTPS терминирует внешний прокси: Caddy из compose.tls.yaml или ваш собственный — см. docs/install-guide.md.
|
|
|
|
# За внешним прокси (Caddy, Traefik, ...) сохраняем исходную схему и IP клиента.
|
|
map $http_x_forwarded_proto $pipu_scheme {
|
|
default $http_x_forwarded_proto;
|
|
'' $scheme;
|
|
}
|
|
|
|
upstream pipu_api {
|
|
server ${API_UPSTREAM};
|
|
keepalive 16;
|
|
}
|
|
|
|
server {
|
|
listen 80;
|
|
server_name _;
|
|
|
|
# Доверяем X-Forwarded-For только от частных сетей (docker, LAN), где стоит прокси.
|
|
set_real_ip_from 10.0.0.0/8;
|
|
set_real_ip_from 172.16.0.0/12;
|
|
set_real_ip_from 192.168.0.0/16;
|
|
real_ip_header X-Forwarded-For;
|
|
real_ip_recursive on;
|
|
|
|
root /usr/share/nginx/html;
|
|
# Two images (album cover + artist portrait), each up to 8 MiB before base64.
|
|
client_max_body_size 32m;
|
|
|
|
include /etc/nginx/snippets/security-headers.conf;
|
|
|
|
gzip on;
|
|
gzip_types text/css application/javascript application/json image/svg+xml;
|
|
|
|
location /api/ {
|
|
proxy_pass http://pipu_api;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Connection "";
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $pipu_scheme;
|
|
# api берёт IP клиента только из X-Real-IP; остальные заголовки клиент может подделать
|
|
proxy_set_header True-Client-IP "";
|
|
}
|
|
|
|
location = /healthz { proxy_pass http://pipu_api; }
|
|
location = /readyz { proxy_pass http://pipu_api; }
|
|
|
|
# Аудио и обложки отдаёт nginx по заголовку X-Accel-Redirect от api (docs/playback.md).
|
|
location /_internal/library/ { internal; alias /library/; sendfile on; aio threads; }
|
|
location /_internal/library-host/ { internal; alias /library-host/; sendfile on; aio threads; }
|
|
location /_internal/cache/ { internal; alias /cache/transcode/; sendfile on; }
|
|
location /_internal/covers/ { internal; alias /cache/covers/; expires 30d; }
|
|
location /_internal/uploads/ { internal; alias /uploads/; sendfile on; }
|
|
|
|
location /assets/ {
|
|
expires 1y;
|
|
include /etc/nginx/snippets/security-headers.conf;
|
|
add_header Cache-Control "public, immutable";
|
|
try_files $uri =404;
|
|
}
|
|
|
|
location / {
|
|
include /etc/nginx/snippets/security-headers.conf;
|
|
add_header Cache-Control "no-cache";
|
|
try_files $uri $uri/ /index.html;
|
|
}
|
|
}
|