NotS1mp/Musify
0
0
Fork 0
Code Issues 23 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(web-player): send presigned uploads to a reachable S3 endpoint

Browse Source 
The PUT was always sent to 127.0.0.1, which is nothing inside the container, so
uploads failed whenever the web player did not run on the same host as
SeaweedFS. Take an optional S3_UPLOAD_ENDPOINT instead (the compose stacks
point it at seaweedfs:8333) and fall back to the host in the presigned URL. The
signed Host header is preserved either way, so the signature still matches.
This commit is contained in:
Admin
2026-07-20 15:13:21 +02:00
parent 28e00ce0ca
commit 29d67e729c
2 changed files with 15 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
web-player/.env.example
+10 -2
View File
@@ -1,3 +1,6 @@
# Local configuration for `npm run dev`. deploy/zitadel/provision.ps1 fills in
# the Zitadel values; in Docker the same variables come from deploy/compose.yml.
# Zitadel OIDC (server-side auth) # Zitadel OIDC (server-side auth)
ZITADEL_ISSUER=http://host.docker.internal:8080 ZITADEL_ISSUER=http://host.docker.internal:8080
ZITADEL_CLIENT_ID=your-web-app-client-id ZITADEL_CLIENT_ID=your-web-app-client-id
@@ -10,6 +13,9 @@ AUTH_POST_LOGOUT_URI=http://localhost:5173/
# Secret used to derive the session cookie encryption key (any long random string) # Secret used to derive the session cookie encryption key (any long random string)
SESSION_SECRET=change-me-to-a-long-random-string SESSION_SECRET=change-me-to-a-long-random-string
# Backend API base URL
API_BASE_URL=http://localhost:5111
# Optional session tuning (defaults shown) # Optional session tuning (defaults shown)
# OIDC_SCOPE=openid profile email offline_access # OIDC_SCOPE=openid profile email offline_access
# SESSION_TTL_SECONDS=604800 # SESSION_TTL_SECONDS=604800
@@ -19,5 +25,7 @@ SESSION_SECRET=change-me-to-a-long-random-string
# Dev already allows a plain-HTTP issuer. Set this only to allow it in a production build (never with a public issuer). # Dev already allows a plain-HTTP issuer. Set this only to allow it in a production build (never with a public issuer).
# AUTH_ALLOW_INSECURE_HTTP=true # AUTH_ALLOW_INSECURE_HTTP=true
# Backend API base URL (used from later parts) # Where to send presigned S3 PUTs when the public S3 host is not reachable from
API_BASE_URL=http://localhost:5111 # the server (in Docker: http://seaweedfs:8333). The signed Host header is kept
# either way. Defaults to the host in the presigned URL.
# S3_UPLOAD_ENDPOINT=http://localhost:8333
web-player/src/lib/server/upload.ts
+5 -4
View File
@@ -2,7 +2,7 @@ import http from 'node:http';
import https from 'node:https'; import https from 'node:https';
import { env } from '$env/dynamic/private'; import { env } from '$env/dynamic/private';
const CONNECT_HOST = env.S3_UPLOAD_CONNECT_HOST || '127.0.0.1'; const UPLOAD_ENDPOINT = env.S3_UPLOAD_ENDPOINT ?? '';
export const IMAGE_TYPES: Record<string, string> = { export const IMAGE_TYPES: Record<string, string> = {
jpg: 'image/jpeg', jpg: 'image/jpeg',
@@ -48,14 +48,15 @@ export async function putPresigned(
if (signed.has('content-type')) headers['Content-Type'] = contentType; if (signed.has('content-type')) headers['Content-Type'] = contentType;
if (signed.has('if-none-match')) headers['If-None-Match'] = '*'; if (signed.has('if-none-match')) headers['If-None-Match'] = '*';
const secure = url.protocol === 'https:'; const target = UPLOAD_ENDPOINT ? new URL(UPLOAD_ENDPOINT) : url;
const secure = target.protocol === 'https:';
const transport = secure ? https : http; const transport = secure ? https : http;
const port = url.port || (secure ? 443 : 80); const port = target.port || (secure ? 443 : 80);
await new Promise<void>((resolve, reject) => { await new Promise<void>((resolve, reject) => {
const request = transport.request( const request = transport.request(
{ {
host: CONNECT_HOST, host: target.hostname,
port, port,
method: 'PUT', method: 'PUT',
path: url.pathname + url.search, path: url.pathname + url.search,