Admin
31032bd8e8
Drops the YouTube-backed second catalog source entirely: the Local/External split on Track/Album collapses into single concrete entities, Artist/TrackArtist/ExternalTrack/ExternalAlbum and the YouTube service/download pipeline (yt-dlp, MassTransit consumer, routing slip) are deleted, and mixes now source discovery only from local listening history. Includes the RemoveYouTubeIntegration EF Core migration and matching Worker/deploy/compose cleanup (no more yt-dlp/python/deno in the Worker image, no thumbnail-cache/YtDlp config sections).
120 lines
3.3 KiB
Plaintext
120 lines
3.3 KiB
Plaintext
# Musify edge. The nginx entrypoint renders this with envsubst into
|
|
# /etc/nginx/conf.d/default.conf (replacing the image's stock file) using the
|
|
# MUSIFY_* variables set in compose.prod.yml.
|
|
#
|
|
# Cloudflare (Full strict) terminates the public edge; this box only needs to
|
|
# serve the Cloudflare Origin Certificate in nginx/certs/. Each vhost proxies to
|
|
# a compose service by name through the embedded Docker DNS resolver, so nginx
|
|
# re-resolves it instead of caching the IP of a container that may be recreated.
|
|
|
|
resolver 127.0.0.11 valid=10s;
|
|
|
|
map $http_upgrade $connection_upgrade {
|
|
default upgrade;
|
|
'' close;
|
|
}
|
|
|
|
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
server_name ${MUSIFY_ROOT_DOMAIN} www.${MUSIFY_ROOT_DOMAIN}
|
|
api.${MUSIFY_ROOT_DOMAIN} auth.${MUSIFY_ROOT_DOMAIN}
|
|
stream.${MUSIFY_ROOT_DOMAIN} s3.${MUSIFY_ROOT_DOMAIN};
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
|
|
# Web player (SvelteKit, adapter-node). Uploads are posted to its own form
|
|
# actions, so it needs the large body size too.
|
|
server {
|
|
listen 443 ssl;
|
|
http2 on;
|
|
server_name ${MUSIFY_ROOT_DOMAIN};
|
|
client_max_body_size ${MUSIFY_MAX_UPLOAD_SIZE};
|
|
|
|
ssl_certificate /etc/nginx/certs/origin.pem;
|
|
ssl_certificate_key /etc/nginx/certs/origin.key;
|
|
|
|
location / {
|
|
set $upstream http://web-player:3000;
|
|
proxy_pass $upstream;
|
|
include /etc/nginx/snippets/proxy.conf;
|
|
}
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl;
|
|
http2 on;
|
|
server_name www.${MUSIFY_ROOT_DOMAIN};
|
|
|
|
ssl_certificate /etc/nginx/certs/origin.pem;
|
|
ssl_certificate_key /etc/nginx/certs/origin.key;
|
|
|
|
return 301 https://${MUSIFY_ROOT_DOMAIN}$request_uri;
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl;
|
|
http2 on;
|
|
server_name api.${MUSIFY_ROOT_DOMAIN};
|
|
|
|
ssl_certificate /etc/nginx/certs/origin.pem;
|
|
ssl_certificate_key /etc/nginx/certs/origin.key;
|
|
|
|
location / {
|
|
set $upstream http://api:5111;
|
|
proxy_pass $upstream;
|
|
include /etc/nginx/snippets/proxy.conf;
|
|
}
|
|
}
|
|
|
|
# Audio bytes. Buffering off keeps range requests (seeking) responsive.
|
|
server {
|
|
listen 443 ssl;
|
|
http2 on;
|
|
server_name stream.${MUSIFY_ROOT_DOMAIN};
|
|
|
|
ssl_certificate /etc/nginx/certs/origin.pem;
|
|
ssl_certificate_key /etc/nginx/certs/origin.key;
|
|
|
|
location / {
|
|
set $upstream http://gateway:8081;
|
|
proxy_pass $upstream;
|
|
include /etc/nginx/snippets/proxy.conf;
|
|
proxy_buffering off;
|
|
}
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl;
|
|
http2 on;
|
|
server_name auth.${MUSIFY_ROOT_DOMAIN};
|
|
|
|
ssl_certificate /etc/nginx/certs/origin.pem;
|
|
ssl_certificate_key /etc/nginx/certs/origin.key;
|
|
|
|
location / {
|
|
set $upstream http://zitadel:8080;
|
|
proxy_pass $upstream;
|
|
include /etc/nginx/snippets/proxy.conf;
|
|
grpc_set_header Host $host;
|
|
}
|
|
}
|
|
|
|
# Presigned S3 PUT/GET straight from the browser.
|
|
server {
|
|
listen 443 ssl;
|
|
http2 on;
|
|
server_name s3.${MUSIFY_ROOT_DOMAIN};
|
|
client_max_body_size ${MUSIFY_MAX_UPLOAD_SIZE};
|
|
|
|
ssl_certificate /etc/nginx/certs/origin.pem;
|
|
ssl_certificate_key /etc/nginx/certs/origin.key;
|
|
|
|
location / {
|
|
set $upstream http://seaweedfs:8333;
|
|
proxy_pass $upstream;
|
|
include /etc/nginx/snippets/proxy.conf;
|
|
proxy_request_buffering off;
|
|
}
|
|
}
|