Paul Nothaft
d1c582396a
Apply shared session, permission, ownership and lifecycle checks across gallery access, media grants and session restoration. Validate mutation origins, pin webhook DNS resolution and redact token-bearing request URLs. Consolidate gallery creation and queries, extract frontend state hooks, fix hook ordering and resource cleanup, and repair the fresh event schema. Update affected dependencies and restore excluded CI suites with regression and cross-database coverage.
69 lines
2.3 KiB
Plaintext
69 lines
2.3 KiB
Plaintext
# URLs and Referer can contain gallery, image and customer bearer tokens.
|
|
map $uri $request_surface {
|
|
~*^/api/(?<picpeak_surface>[a-z-]+)(?:/|$) /api/$picpeak_surface;
|
|
default /;
|
|
}
|
|
log_format picpeak_safe '$remote_addr [$time_local] "$request_method $request_surface" '
|
|
'$status $body_bytes_sent $request_time';
|
|
|
|
# Honour outer reverse-proxy's X-Forwarded-Proto when present (see #547 /
|
|
# frontend/nginx.conf for full rationale).
|
|
map $http_x_forwarded_proto $real_proto {
|
|
default $http_x_forwarded_proto;
|
|
"" $scheme;
|
|
}
|
|
|
|
server {
|
|
access_log /var/log/nginx/access.log picpeak_safe;
|
|
# Request error logs expose raw token URLs; use safe access statuses.
|
|
error_log /dev/null;
|
|
listen 80;
|
|
server_name localhost;
|
|
root /usr/share/nginx/html;
|
|
|
|
# API proxy to backend
|
|
location /api {
|
|
proxy_pass http://backend:3000;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $real_proto;
|
|
}
|
|
|
|
# Photos proxy to backend
|
|
location /photos {
|
|
proxy_pass http://backend:3000;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
}
|
|
|
|
# Health check
|
|
location /health {
|
|
access_log off;
|
|
return 200 "healthy\n";
|
|
add_header Content-Type text/plain;
|
|
}
|
|
|
|
# Gallery share URLs: route social-crawler UAs to backend OG handler.
|
|
location ~ ^/gallery/(?<gallery_slug>[A-Za-z0-9_-]+)(?:/[^/]+)?/?$ {
|
|
if ($http_user_agent ~* "(facebookexternalhit|facebot|Twitterbot|WhatsApp|Slackbot|TelegramBot|SkypeUriPreview|Discordbot|LinkedInBot|Pinterest|vkShare|redditbot|Embedly|iframely|Snapchat|Applebot|Mastodon|Bluesky|OpenGraph)") {
|
|
rewrite ^ /og/gallery/$gallery_slug last;
|
|
}
|
|
try_files $uri $uri/ /index.html;
|
|
}
|
|
|
|
location ^~ /og/gallery/ {
|
|
proxy_pass http://backend:3000;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $real_proto;
|
|
}
|
|
|
|
# SPA fallback
|
|
location / {
|
|
try_files $uri $uri/ /index.html;
|
|
}
|
|
} |