Paul Nothaft
f0e6d2dfb1
Harden gallery authentication and authorization, consolidate gallery workflows, and prevent token-bearing URLs from leaking through nginx request error logs.
71 lines
2.4 KiB
Plaintext
71 lines
2.4 KiB
Plaintext
# URLs and Referer can contain gallery, image and customer bearer tokens.
|
|
map $uri $request_surface {
|
|
~*^/api/(?<picpeak_surface>[a-z-]+)(?:/|$) /api/$picpeak_surface;
|
|
default /;
|
|
}
|
|
log_format picpeak_safe '$remote_addr "$http_x_forwarded_for" [$time_local] "$request_method $request_surface" '
|
|
'$status $body_bytes_sent $request_time';
|
|
|
|
# Honour outer reverse-proxy's X-Forwarded-Proto when present (see #547 /
|
|
# frontend/nginx.conf for full rationale).
|
|
map $http_x_forwarded_proto $real_proto {
|
|
default $http_x_forwarded_proto;
|
|
"" $scheme;
|
|
}
|
|
|
|
server {
|
|
access_log /var/log/nginx/access.log picpeak_safe;
|
|
# Native request errors include bearer URLs even at crit/alert severity.
|
|
# Safe access logs retain status/timing; process diagnostics stay at main level.
|
|
error_log /dev/null;
|
|
listen 80;
|
|
server_name localhost;
|
|
root /usr/share/nginx/html;
|
|
|
|
# API proxy to backend
|
|
location /api {
|
|
proxy_pass http://backend:3000;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $real_proto;
|
|
}
|
|
|
|
# Photos proxy to backend
|
|
location /photos {
|
|
proxy_pass http://backend:3000;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
}
|
|
|
|
# Health check
|
|
location /health {
|
|
access_log off;
|
|
return 200 "healthy\n";
|
|
add_header Content-Type text/plain;
|
|
}
|
|
|
|
# Gallery share URLs: route social-crawler UAs to backend OG handler.
|
|
location ~ ^/gallery/(?<gallery_slug>[A-Za-z0-9_-]+)(?:/[^/]+)?/?$ {
|
|
if ($http_user_agent ~* "(facebookexternalhit|facebot|Twitterbot|WhatsApp|Slackbot|TelegramBot|SkypeUriPreview|Discordbot|LinkedInBot|Pinterest|vkShare|redditbot|Embedly|iframely|Snapchat|Applebot|Mastodon|Bluesky|OpenGraph)") {
|
|
rewrite ^ /og/gallery/$gallery_slug last;
|
|
}
|
|
try_files $uri $uri/ /index.html;
|
|
}
|
|
|
|
location ^~ /og/gallery/ {
|
|
proxy_pass http://backend:3000;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $real_proto;
|
|
}
|
|
|
|
# SPA fallback
|
|
location / {
|
|
try_files $uri $uri/ /index.html;
|
|
}
|
|
}
|