vh
d1192ca868
Prime's directive via pewpew-dev. Images are built on nh3-dev from a clean archive of vh/pewpewstudio (26bba3c; hamr over gitea SSH via BuildKit --ssh) and loaded on nh3-docker. Caddy serves the SPA and strips /api/ in front of the backend. It refuses foreign Host headers inside a route block, because the Host rewrite would otherwise bypass the backend's TrustedHost. The DB, assets and the app-edited shop config live on named volumes inside nh3-docker's nightly vzdump. Verified: SPA, /api/machines and /api/generate/workflows 200; foreign Host 400.
22 lines
985 B
Caddyfile
22 lines
985 B
Caddyfile
# pewpewstudio's front: the SPA at /, /api/* to the backend with the prefix STRIPPED (the backend has no /api routes and
|
|
# no CORS, so both must be one origin). The backend's TrustedHost accepts localhost, so Host is rewritten to it.
|
|
# No request-body cap here: asset uploads are capped at 32 MB by the app itself. LAN/mesh only, no auth in v1.
|
|
:80 {
|
|
encode zstd gzip
|
|
# `route` keeps this literal order; outside it Caddy sorts `respond` AFTER handle/handle_path, and the Host check
|
|
# would never run (measured: a foreign Host got 200 before this was a route).
|
|
route {
|
|
# Keep the backend's TrustedHost meaning (DNS-rebinding defence): the proxy rewrites Host to localhost below,
|
|
# so it must refuse any Host the app would refuse. Add a name here when one is published for it.
|
|
@foreign not host 10.100.50.40 nh3-docker.nh3.internal
|
|
respond @foreign 400
|
|
handle_path /api/* {
|
|
reverse_proxy api:8000 {
|
|
header_up Host localhost
|
|
}
|
|
}
|
|
root * /srv
|
|
file_server
|
|
}
|
|
}
|