Admin
6dcbd9589a
Zitadel v4 redirects every sign-in to /ui/v2/login, which is served by a separate container (zitadel-login) that this stack didn't run, so logging in on a fresh instance ended in a 404. - Add zitadel-login, with its own service account (login-client) whose PAT Zitadel writes to a volume only that container mounts. - Configure the Login V2 base URL (ZITADEL_LOGIN_BASE_URL): its own port in dev, same hostname as Zitadel behind the edge in prod. - Pin zitadel and zitadel-login to v4.19.1 and add healthchecks. - Run Zitadel as root, as Zitadel's own compose does, so it can write the PATs into root-owned mounts (the Linux bind mount and the new volume). - Route /ui/v2/login on the auth vhost to the login container and drop the no-op grpc_set_header. - Document the extra steps for an instance created before this.
116 lines
3.4 KiB
Plaintext
116 lines
3.4 KiB
Plaintext
# One certificate (live/musify.ikerdemo.cat) covers the five hostnames.
|
|
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
server_name musify.ikerdemo.cat musifyapi.ikerdemo.cat
|
|
musifystream.ikerdemo.cat auth.ikerdemo.cat s3.ikerdemo.cat;
|
|
include /etc/nginx/snippets/acme-redirect.conf;
|
|
}
|
|
|
|
# Web player. Uploads are posted to its own form actions.
|
|
server {
|
|
listen 443 ssl;
|
|
listen [::]:443 ssl;
|
|
http2 on;
|
|
server_name musify.ikerdemo.cat;
|
|
client_max_body_size 1024m;
|
|
|
|
# The OIDC callback answers with the session cookies (encrypted tokens),
|
|
# bigger than the 4k default response-header buffer.
|
|
proxy_buffer_size 32k;
|
|
proxy_buffers 8 32k;
|
|
proxy_busy_buffers_size 64k;
|
|
large_client_header_buffers 4 16k;
|
|
|
|
ssl_certificate /etc/letsencrypt/live/musify.ikerdemo.cat/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/musify.ikerdemo.cat/privkey.pem;
|
|
include /etc/nginx/snippets/tls.conf;
|
|
|
|
location / {
|
|
set $upstream http://web-player:3000;
|
|
proxy_pass $upstream;
|
|
include /etc/nginx/snippets/proxy.conf;
|
|
}
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl;
|
|
listen [::]:443 ssl;
|
|
http2 on;
|
|
server_name musifyapi.ikerdemo.cat;
|
|
|
|
ssl_certificate /etc/letsencrypt/live/musify.ikerdemo.cat/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/musify.ikerdemo.cat/privkey.pem;
|
|
include /etc/nginx/snippets/tls.conf;
|
|
|
|
location / {
|
|
set $upstream http://api:5111;
|
|
proxy_pass $upstream;
|
|
include /etc/nginx/snippets/proxy.conf;
|
|
}
|
|
}
|
|
|
|
# Audio bytes. Buffering off keeps range requests (seeking) responsive.
|
|
server {
|
|
listen 443 ssl;
|
|
listen [::]:443 ssl;
|
|
http2 on;
|
|
server_name musifystream.ikerdemo.cat;
|
|
|
|
ssl_certificate /etc/letsencrypt/live/musify.ikerdemo.cat/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/musify.ikerdemo.cat/privkey.pem;
|
|
include /etc/nginx/snippets/tls.conf;
|
|
|
|
location / {
|
|
set $upstream http://gateway:8081;
|
|
proxy_pass $upstream;
|
|
include /etc/nginx/snippets/proxy.conf;
|
|
proxy_buffering off;
|
|
}
|
|
}
|
|
|
|
# Zitadel, shared with the other projects (hence the generic hostname).
|
|
server {
|
|
listen 443 ssl;
|
|
listen [::]:443 ssl;
|
|
http2 on;
|
|
server_name auth.ikerdemo.cat;
|
|
|
|
ssl_certificate /etc/letsencrypt/live/musify.ikerdemo.cat/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/musify.ikerdemo.cat/privkey.pem;
|
|
include /etc/nginx/snippets/tls.conf;
|
|
|
|
# Login V2 UI, a separate container (see ../compose.yml).
|
|
location /ui/v2/login {
|
|
set $upstream http://infra-zitadel-login:3000;
|
|
proxy_pass $upstream;
|
|
include /etc/nginx/snippets/proxy.conf;
|
|
}
|
|
|
|
location / {
|
|
set $upstream http://zitadel:8080;
|
|
proxy_pass $upstream;
|
|
include /etc/nginx/snippets/proxy.conf;
|
|
}
|
|
}
|
|
|
|
# SeaweedFS S3: presigned PUT/GET straight from the browser.
|
|
server {
|
|
listen 443 ssl;
|
|
listen [::]:443 ssl;
|
|
http2 on;
|
|
server_name s3.ikerdemo.cat;
|
|
client_max_body_size 1024m;
|
|
|
|
ssl_certificate /etc/letsencrypt/live/musify.ikerdemo.cat/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/musify.ikerdemo.cat/privkey.pem;
|
|
include /etc/nginx/snippets/tls.conf;
|
|
|
|
location / {
|
|
set $upstream http://seaweedfs:8333;
|
|
proxy_pass $upstream;
|
|
include /etc/nginx/snippets/proxy.conf;
|
|
proxy_request_buffering off;
|
|
}
|
|
}
|