Paul Nothaft
99f857c1d1
Suppress native request errors at every severity while retaining safe access logs and process diagnostics. Exercise ordinary and critical upstream failures across all four configs and both shipped nginx versions in Docker, with controls that prove the critical error path is reached. Strengthen gallery pagination coverage using deferred responses to assert the four-request cap and server order under out-of-order completion.
71 lines
2.4 KiB
Plaintext
71 lines
2.4 KiB
Plaintext
# URLs and Referer can contain gallery, image and customer bearer tokens.
|
|
map $uri $request_surface {
|
|
~*^/api/(?<picpeak_surface>[a-z-]+)(?:/|$) /api/$picpeak_surface;
|
|
default /;
|
|
}
|
|
log_format picpeak_safe '$remote_addr "$http_x_forwarded_for" [$time_local] "$request_method $request_surface" '
|
|
'$status $body_bytes_sent $request_time';
|
|
|
|
# Honour outer reverse-proxy's X-Forwarded-Proto when present (see #547 /
|
|
# frontend/nginx.conf for full rationale).
|
|
map $http_x_forwarded_proto $real_proto {
|
|
default $http_x_forwarded_proto;
|
|
"" $scheme;
|
|
}
|
|
|
|
server {
|
|
access_log /var/log/nginx/access.log picpeak_safe;
|
|
# Native request errors include bearer URLs even at crit/alert severity.
|
|
# Safe access logs retain status/timing; process diagnostics stay at main level.
|
|
error_log /dev/null;
|
|
listen 80;
|
|
server_name localhost;
|
|
root /usr/share/nginx/html;
|
|
|
|
# API proxy to backend
|
|
location /api {
|
|
proxy_pass http://backend:3000;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $real_proto;
|
|
}
|
|
|
|
# Photos proxy to backend
|
|
location /photos {
|
|
proxy_pass http://backend:3000;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
}
|
|
|
|
# Health check
|
|
location /health {
|
|
access_log off;
|
|
return 200 "healthy\n";
|
|
add_header Content-Type text/plain;
|
|
}
|
|
|
|
# Gallery share URLs: route social-crawler UAs to backend OG handler.
|
|
location ~ ^/gallery/(?<gallery_slug>[A-Za-z0-9_-]+)(?:/[^/]+)?/?$ {
|
|
if ($http_user_agent ~* "(facebookexternalhit|facebot|Twitterbot|WhatsApp|Slackbot|TelegramBot|SkypeUriPreview|Discordbot|LinkedInBot|Pinterest|vkShare|redditbot|Embedly|iframely|Snapchat|Applebot|Mastodon|Bluesky|OpenGraph)") {
|
|
rewrite ^ /og/gallery/$gallery_slug last;
|
|
}
|
|
try_files $uri $uri/ /index.html;
|
|
}
|
|
|
|
location ^~ /og/gallery/ {
|
|
proxy_pass http://backend:3000;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $real_proto;
|
|
}
|
|
|
|
# SPA fallback
|
|
location / {
|
|
try_files $uri $uri/ /index.html;
|
|
}
|
|
}
|