Admin
49130705e3
ikerdemo.cat was hardcoded in six server blocks, so the stack could only be deployed under that one domain. The vhosts are now a template rendered by the nginx entrypoint from MUSIFY_ROOT_DOMAIN, with the envsubst filter set so it does not eat nginx's own variables. The repeated proxy headers move to a shared snippet, the web player vhost gets the upload body limit it was missing (audio is posted to its form actions), and the streaming vhost turns off proxy buffering so range requests stay responsive.
120 lines
3.3 KiB
Plaintext
120 lines
3.3 KiB
Plaintext
# Musify edge. The nginx entrypoint renders this with envsubst into
|
|
# /etc/nginx/conf.d/default.conf (replacing the image's stock file) using the
|
|
# MUSIFY_* variables set in compose.prod.yml.
|
|
#
|
|
# Cloudflare (Full strict) terminates the public edge; this box only needs to
|
|
# serve the Cloudflare Origin Certificate in nginx/certs/. Each vhost proxies to
|
|
# a compose service by name through the embedded Docker DNS resolver, so nginx
|
|
# re-resolves it instead of caching the IP of a container that may be recreated.
|
|
|
|
resolver 127.0.0.11 valid=10s;
|
|
|
|
map $http_upgrade $connection_upgrade {
|
|
default upgrade;
|
|
'' close;
|
|
}
|
|
|
|
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
server_name ${MUSIFY_ROOT_DOMAIN} www.${MUSIFY_ROOT_DOMAIN}
|
|
api.${MUSIFY_ROOT_DOMAIN} auth.${MUSIFY_ROOT_DOMAIN}
|
|
stream.${MUSIFY_ROOT_DOMAIN} s3.${MUSIFY_ROOT_DOMAIN};
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
|
|
# Web player (SvelteKit, adapter-node). Uploads are posted to its own form
|
|
# actions, so it needs the large body size too.
|
|
server {
|
|
listen 443 ssl;
|
|
http2 on;
|
|
server_name ${MUSIFY_ROOT_DOMAIN};
|
|
client_max_body_size ${MUSIFY_MAX_UPLOAD_SIZE};
|
|
|
|
ssl_certificate /etc/nginx/certs/origin.pem;
|
|
ssl_certificate_key /etc/nginx/certs/origin.key;
|
|
|
|
location / {
|
|
set $upstream http://web-player:3000;
|
|
proxy_pass $upstream;
|
|
include /etc/nginx/snippets/proxy.conf;
|
|
}
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl;
|
|
http2 on;
|
|
server_name www.${MUSIFY_ROOT_DOMAIN};
|
|
|
|
ssl_certificate /etc/nginx/certs/origin.pem;
|
|
ssl_certificate_key /etc/nginx/certs/origin.key;
|
|
|
|
return 301 https://${MUSIFY_ROOT_DOMAIN}$request_uri;
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl;
|
|
http2 on;
|
|
server_name api.${MUSIFY_ROOT_DOMAIN};
|
|
|
|
ssl_certificate /etc/nginx/certs/origin.pem;
|
|
ssl_certificate_key /etc/nginx/certs/origin.key;
|
|
|
|
location / {
|
|
set $upstream http://api:5111;
|
|
proxy_pass $upstream;
|
|
include /etc/nginx/snippets/proxy.conf;
|
|
}
|
|
}
|
|
|
|
# Audio bytes. Buffering off keeps range requests (seeking) responsive.
|
|
server {
|
|
listen 443 ssl;
|
|
http2 on;
|
|
server_name stream.${MUSIFY_ROOT_DOMAIN};
|
|
|
|
ssl_certificate /etc/nginx/certs/origin.pem;
|
|
ssl_certificate_key /etc/nginx/certs/origin.key;
|
|
|
|
location / {
|
|
set $upstream http://gateway:8081;
|
|
proxy_pass $upstream;
|
|
include /etc/nginx/snippets/proxy.conf;
|
|
proxy_buffering off;
|
|
}
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl;
|
|
http2 on;
|
|
server_name auth.${MUSIFY_ROOT_DOMAIN};
|
|
|
|
ssl_certificate /etc/nginx/certs/origin.pem;
|
|
ssl_certificate_key /etc/nginx/certs/origin.key;
|
|
|
|
location / {
|
|
set $upstream http://zitadel:8080;
|
|
proxy_pass $upstream;
|
|
include /etc/nginx/snippets/proxy.conf;
|
|
grpc_set_header Host $host;
|
|
}
|
|
}
|
|
|
|
# Presigned S3 PUT/GET straight from the browser.
|
|
server {
|
|
listen 443 ssl;
|
|
http2 on;
|
|
server_name s3.${MUSIFY_ROOT_DOMAIN};
|
|
client_max_body_size ${MUSIFY_MAX_UPLOAD_SIZE};
|
|
|
|
ssl_certificate /etc/nginx/certs/origin.pem;
|
|
ssl_certificate_key /etc/nginx/certs/origin.key;
|
|
|
|
location / {
|
|
set $upstream http://seaweedfs:8333;
|
|
proxy_pass $upstream;
|
|
include /etc/nginx/snippets/proxy.conf;
|
|
proxy_request_buffering off;
|
|
}
|
|
}
|