From 9826c1c718a1d559d6a2a6e28f3a7f11e9e36a5e Mon Sep 17 00:00:00 2001 From: XShine555 Date: Mon, 20 Jul 2026 15:13:21 +0200 Subject: [PATCH] fix(web-player): send presigned uploads to a reachable S3 endpoint The PUT was always sent to 127.0.0.1, which is nothing inside the container, so uploads failed whenever the web player did not run on the same host as SeaweedFS. Take an optional S3_UPLOAD_ENDPOINT instead (the compose stacks point it at seaweedfs:8333) and fall back to the host in the presigned URL. The signed Host header is preserved either way, so the signature still matches. --- web-player/.env.example | 12 ++++++++++-- web-player/src/lib/server/upload.ts | 9 +++++---- 2 files changed, 15 insertions(+), 6 deletions(-) diff --git a/web-player/.env.example b/web-player/.env.example index 5fc0011..7430bd4 100644 --- a/web-player/.env.example +++ b/web-player/.env.example @@ -1,3 +1,6 @@ +# Local configuration for `npm run dev`. deploy/zitadel/provision.ps1 fills in +# the Zitadel values; in Docker the same variables come from deploy/compose.yml. + # Zitadel OIDC (server-side auth) ZITADEL_ISSUER=http://host.docker.internal:8080 ZITADEL_CLIENT_ID=your-web-app-client-id @@ -10,6 +13,9 @@ AUTH_POST_LOGOUT_URI=http://localhost:5173/ # Secret used to derive the session cookie encryption key (any long random string) SESSION_SECRET=change-me-to-a-long-random-string +# Backend API base URL +API_BASE_URL=http://localhost:5111 + # Optional session tuning (defaults shown) # OIDC_SCOPE=openid profile email offline_access # SESSION_TTL_SECONDS=604800 @@ -19,5 +25,7 @@ SESSION_SECRET=change-me-to-a-long-random-string # Dev already allows a plain-HTTP issuer. Set this only to allow it in a production build (never with a public issuer). # AUTH_ALLOW_INSECURE_HTTP=true -# Backend API base URL (used from later parts) -API_BASE_URL=http://localhost:5111 +# Where to send presigned S3 PUTs when the public S3 host is not reachable from +# the server (in Docker: http://seaweedfs:8333). The signed Host header is kept +# either way. Defaults to the host in the presigned URL. +# S3_UPLOAD_ENDPOINT=http://localhost:8333 diff --git a/web-player/src/lib/server/upload.ts b/web-player/src/lib/server/upload.ts index 18f78a0..c21ce52 100644 --- a/web-player/src/lib/server/upload.ts +++ b/web-player/src/lib/server/upload.ts @@ -2,7 +2,7 @@ import http from 'node:http'; import https from 'node:https'; import { env } from '$env/dynamic/private'; -const CONNECT_HOST = env.S3_UPLOAD_CONNECT_HOST || '127.0.0.1'; +const UPLOAD_ENDPOINT = env.S3_UPLOAD_ENDPOINT ?? ''; export const IMAGE_TYPES: Record = { jpg: 'image/jpeg', @@ -48,14 +48,15 @@ export async function putPresigned( if (signed.has('content-type')) headers['Content-Type'] = contentType; if (signed.has('if-none-match')) headers['If-None-Match'] = '*'; - const secure = url.protocol === 'https:'; + const target = UPLOAD_ENDPOINT ? new URL(UPLOAD_ENDPOINT) : url; + const secure = target.protocol === 'https:'; const transport = secure ? https : http; - const port = url.port || (secure ? 443 : 80); + const port = target.port || (secure ? 443 : 80); await new Promise((resolve, reject) => { const request = transport.request( { - host: CONNECT_HOST, + host: target.hostname, port, method: 'PUT', path: url.pathname + url.search,