From cb37a1e23c0f19fd1ed4b2c0242cebcabcae93c8 Mon Sep 17 00:00:00 2001 From: nobswebdev Date: Wed, 28 Oct 2026 20:56:21 +0100 Subject: [PATCH] Add prod nginx image with clearnet, onion, and SPA build. Multi-stage frontend embed, envsubst entrypoint for TLS vhosts and upload body limits, shared locations with minimal response headers and zero access logs. --- nginx/.gitkeep | 0 nginx/Dockerfile.prod | 46 ++++++++++++++++++ nginx/conf.d/clearnet.conf.template | 28 +++++++++++ nginx/conf.d/onion.conf.template | 8 ++++ nginx/docker-entrypoint.sh | 47 ++++++++++++++++++ .../private-image-locations.conf.template | 48 +++++++++++++++++++ 6 files changed, 177 insertions(+) delete mode 100644 nginx/.gitkeep create mode 100644 nginx/Dockerfile.prod create mode 100644 nginx/conf.d/clearnet.conf.template create mode 100644 nginx/conf.d/onion.conf.template create mode 100644 nginx/docker-entrypoint.sh create mode 100644 nginx/snippets/private-image-locations.conf.template diff --git a/nginx/.gitkeep b/nginx/.gitkeep deleted file mode 100644 index e69de29..0000000 diff --git a/nginx/Dockerfile.prod b/nginx/Dockerfile.prod new file mode 100644 index 0000000..82a3fe7 --- /dev/null +++ b/nginx/Dockerfile.prod @@ -0,0 +1,46 @@ +FROM node:22.23.4-alpine AS frontend-builder + +WORKDIR /frontend + +COPY frontend/package*.json . +COPY frontend/patches ./patches + +RUN npm ci + +COPY frontend/ . + +ARG VITE_API_BASE_URL +ARG VITE_CLEARNET_SCHEME +ARG VITE_CLEARNET_DOMAIN +ARG VITE_ONION_HOSTNAME +ARG VITE_ALTCHA_ENABLED +ARG VITE_ALTCHA_MAX_NUMBER +ARG VITE_UPLOAD_MAX_QUEUE_SIZE +ARG VITE_VALIDATION_UPLOAD_MAX_VIEWS_MAX +ARG VITE_VALIDATION_UPLOAD_MAX_IMAGE_BYTES + +ENV VITE_API_BASE_URL=$VITE_API_BASE_URL \ + VITE_CLEARNET_SCHEME=$VITE_CLEARNET_SCHEME \ + VITE_CLEARNET_DOMAIN=$VITE_CLEARNET_DOMAIN \ + VITE_ONION_HOSTNAME=$VITE_ONION_HOSTNAME \ + VITE_ALTCHA_ENABLED=$VITE_ALTCHA_ENABLED \ + VITE_ALTCHA_MAX_NUMBER=$VITE_ALTCHA_MAX_NUMBER \ + VITE_UPLOAD_MAX_QUEUE_SIZE=$VITE_UPLOAD_MAX_QUEUE_SIZE \ + VITE_VALIDATION_UPLOAD_MAX_VIEWS_MAX=$VITE_VALIDATION_UPLOAD_MAX_VIEWS_MAX \ + VITE_VALIDATION_UPLOAD_MAX_IMAGE_BYTES=$VITE_VALIDATION_UPLOAD_MAX_IMAGE_BYTES + +RUN npm run build + +FROM nginx:1.29.4-alpine + +RUN apk add --no-cache gettext + +COPY --from=frontend-builder /frontend/dist /usr/share/nginx/html + +COPY nginx/conf.d/ /etc/nginx/templates/conf.d/ +COPY nginx/snippets/private-image-locations.conf.template /etc/nginx/templates/snippets/ +COPY nginx/docker-entrypoint.sh /docker-entrypoint.sh + +RUN chmod +x /docker-entrypoint.sh + +ENTRYPOINT ["/docker-entrypoint.sh"] diff --git a/nginx/conf.d/clearnet.conf.template b/nginx/conf.d/clearnet.conf.template new file mode 100644 index 0000000..d37991e --- /dev/null +++ b/nginx/conf.d/clearnet.conf.template @@ -0,0 +1,28 @@ +server { + listen 80; + server_name ${CLEARNET_DOMAIN} www.${CLEARNET_DOMAIN}; + + access_log off; + + location /.well-known/acme-challenge/ { + root /var/www/certbot; + } + + location / { + return 301 https://$host$request_uri; + } +} + +server { + listen 443 ssl; + server_name ${CLEARNET_DOMAIN} www.${CLEARNET_DOMAIN}; + + access_log off; + + ssl_certificate /etc/nginx/certs/live/${CLEARNET_DOMAIN}/fullchain.pem; + ssl_certificate_key /etc/nginx/certs/live/${CLEARNET_DOMAIN}/privkey.pem; + + ${ONION_LOCATION_HEADER} + + include /etc/nginx/snippets/private-image-locations.conf; +} diff --git a/nginx/conf.d/onion.conf.template b/nginx/conf.d/onion.conf.template new file mode 100644 index 0000000..4001b3b --- /dev/null +++ b/nginx/conf.d/onion.conf.template @@ -0,0 +1,8 @@ +server { + listen 8080; + server_name _; + + access_log off; + + include /etc/nginx/snippets/private-image-locations.conf; +} diff --git a/nginx/docker-entrypoint.sh b/nginx/docker-entrypoint.sh new file mode 100644 index 0000000..e074dde --- /dev/null +++ b/nginx/docker-entrypoint.sh @@ -0,0 +1,47 @@ +#!/bin/sh +set -eu + +max_image_bytes="${VALIDATION_UPLOAD_MAX_IMAGE_BYTES:?}" +json_padding="${VALIDATION_UPLOAD_JSON_BODY_PADDING_BYTES:?}" + +UPLOAD_MAX_REQUEST_BODY_BYTES=$(( (max_image_bytes * 4 + 2) / 3 + json_padding )) + +export UPLOAD_MAX_REQUEST_BODY_BYTES BACKEND_PORT + +render_locations() { + envsubst '${BACKEND_PORT} ${UPLOAD_MAX_REQUEST_BODY_BYTES}' \ + < /etc/nginx/templates/snippets/private-image-locations.conf.template \ + > /etc/nginx/snippets/private-image-locations.conf +} + +render_server() { + template_path="$1" + output_path="$2" + surface="$3" + + if [ "$surface" = "clearnet" ]; then + if [ -n "${ONION_HOSTNAME:-}" ]; then + export ONION_LOCATION_HEADER="add_header Onion-Location \"http://${ONION_HOSTNAME}\$request_uri\";" + else + export ONION_LOCATION_HEADER="" + fi + + export CLEARNET_DOMAIN + + envsubst '${CLEARNET_DOMAIN} ${ONION_LOCATION_HEADER}' \ + < "$template_path" \ + > "$output_path" + + return + fi + + cp "$template_path" "$output_path" +} + +mkdir -p /etc/nginx/snippets + +render_locations +render_server /etc/nginx/templates/conf.d/clearnet.conf.template /etc/nginx/conf.d/clearnet.conf clearnet +render_server /etc/nginx/templates/conf.d/onion.conf.template /etc/nginx/conf.d/onion.conf onion + +exec nginx -g 'daemon off;' diff --git a/nginx/snippets/private-image-locations.conf.template b/nginx/snippets/private-image-locations.conf.template new file mode 100644 index 0000000..c8611ec --- /dev/null +++ b/nginx/snippets/private-image-locations.conf.template @@ -0,0 +1,48 @@ +location ^~ /i/ { + add_header X-Content-Type-Options "nosniff" always; + add_header Cross-Origin-Resource-Policy "cross-origin" always; + add_header Cache-Control "private, no-store" always; + + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_pass http://backend:${BACKEND_PORT}; +} + +location /api { + client_max_body_size ${UPLOAD_MAX_REQUEST_BODY_BYTES}; + + add_header Cache-Control "no-store" always; + + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_read_timeout 600s; + proxy_send_timeout 600s; + + proxy_pass http://backend:${BACKEND_PORT}; +} + +location /pgadmin { + proxy_set_header X-Script-Name /pgadmin; + proxy_set_header Host $host; + proxy_set_header X-Scheme $scheme; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + + proxy_pass_header Set-Cookie; + + proxy_pass http://pgadmin; + + proxy_redirect off; +} + +location / { + add_header Referrer-Policy "no-referrer" always; + add_header Cache-Control "no-store" always; + + root /usr/share/nginx/html; + + try_files $uri $uri/ /index.html; +}