110 lines
3.0 KiB
Plaintext
110 lines
3.0 KiB
Plaintext
# Musify edge. The nginx entrypoint renders this with envsubst into
|
|
# /etc/nginx/conf.d/default.conf (replacing the image's stock file) using the
|
|
# MUSIFY_* variables set in compose.prod.yml. Each vhost has its own,
|
|
# independent domain (see deploy/.env.prod.example) — they don't need to
|
|
# share a root domain.
|
|
#
|
|
# Cloudflare (Full strict) terminates the public edge; this box only needs to
|
|
# serve the Cloudflare Origin Certificate in nginx/certs/. Each vhost proxies to
|
|
# a compose service by name through the embedded Docker DNS resolver, so nginx
|
|
# re-resolves it instead of caching the IP of a container that may be recreated.
|
|
|
|
resolver 127.0.0.11 valid=10s;
|
|
|
|
map $http_upgrade $connection_upgrade {
|
|
default upgrade;
|
|
'' close;
|
|
}
|
|
|
|
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
server_name ${MUSIFY_WEB_DOMAIN} ${MUSIFY_API_DOMAIN}
|
|
${MUSIFY_AUTH_DOMAIN} ${MUSIFY_STREAM_DOMAIN} ${MUSIFY_S3_DOMAIN};
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
|
|
# Web player (SvelteKit, adapter-node). Uploads are posted to its own form
|
|
# actions, so it needs the large body size too.
|
|
server {
|
|
listen 443 ssl;
|
|
http2 on;
|
|
server_name ${MUSIFY_WEB_DOMAIN};
|
|
client_max_body_size ${MUSIFY_MAX_UPLOAD_SIZE};
|
|
|
|
ssl_certificate /etc/nginx/certs/origin.pem;
|
|
ssl_certificate_key /etc/nginx/certs/origin.key;
|
|
|
|
location / {
|
|
set $upstream http://web-player:3000;
|
|
proxy_pass $upstream;
|
|
include /etc/nginx/snippets/proxy.conf;
|
|
}
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl;
|
|
http2 on;
|
|
server_name ${MUSIFY_API_DOMAIN};
|
|
|
|
ssl_certificate /etc/nginx/certs/origin.pem;
|
|
ssl_certificate_key /etc/nginx/certs/origin.key;
|
|
|
|
location / {
|
|
set $upstream http://api:5111;
|
|
proxy_pass $upstream;
|
|
include /etc/nginx/snippets/proxy.conf;
|
|
}
|
|
}
|
|
|
|
# Audio bytes. Buffering off keeps range requests (seeking) responsive.
|
|
server {
|
|
listen 443 ssl;
|
|
http2 on;
|
|
server_name ${MUSIFY_STREAM_DOMAIN};
|
|
|
|
ssl_certificate /etc/nginx/certs/origin.pem;
|
|
ssl_certificate_key /etc/nginx/certs/origin.key;
|
|
|
|
location / {
|
|
set $upstream http://gateway:8081;
|
|
proxy_pass $upstream;
|
|
include /etc/nginx/snippets/proxy.conf;
|
|
proxy_buffering off;
|
|
}
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl;
|
|
http2 on;
|
|
server_name ${MUSIFY_AUTH_DOMAIN};
|
|
|
|
ssl_certificate /etc/nginx/certs/origin.pem;
|
|
ssl_certificate_key /etc/nginx/certs/origin.key;
|
|
|
|
location / {
|
|
set $upstream http://zitadel:8080;
|
|
proxy_pass $upstream;
|
|
include /etc/nginx/snippets/proxy.conf;
|
|
grpc_set_header Host $host;
|
|
}
|
|
}
|
|
|
|
# Presigned S3 PUT/GET straight from the browser.
|
|
server {
|
|
listen 443 ssl;
|
|
http2 on;
|
|
server_name ${MUSIFY_S3_DOMAIN};
|
|
client_max_body_size ${MUSIFY_MAX_UPLOAD_SIZE};
|
|
|
|
ssl_certificate /etc/nginx/certs/origin.pem;
|
|
ssl_certificate_key /etc/nginx/certs/origin.key;
|
|
|
|
location / {
|
|
set $upstream http://seaweedfs:8333;
|
|
proxy_pass $upstream;
|
|
include /etc/nginx/snippets/proxy.conf;
|
|
proxy_request_buffering off;
|
|
}
|
|
}
|