rob thijssen
81fe5f7d4d
8081 is the alt-HTTP port — one of the crowded defaults every proxy/dev server grabs — so it's collision-prone on a shared host. Move to 22672, a registered- range port in the sparse 20000s band, derived deterministically from the service name and recorded in architecture port-allocations.md. Updated everywhere the number appears: api bind config + default, firewalld service XML, nginx upstream, vite dev proxy, deploy workflow API_PORT, infra-setup (SELinux semanage label), and docs. Operator note: re-run script/infra-setup.sh on slartibartfast to relabel the SELinux port (22672) and ship the updated firewalld XML before the next deploy restarts the api on the new port. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016fKZzDpvjiJ9eYbPGgJvUP
54 lines
1.8 KiB
Plaintext
54 lines
1.8 KiB
Plaintext
# Mesh-only vhost for newsfeed, fronted by the oolon edge proxy (kosherinata site).
|
|
# Cert: internal `lair` CA, minted by infra-setup.sh and renewed by step@newsfeed.timer
|
|
# (see architecture internal-tls.md). Serves the static SPA and reverse-proxies the API
|
|
# to the newsfeed-api daemon on slartibartfast over the WireGuard mesh.
|
|
#
|
|
# Enable with a relative symlink into sites-enabled (reverse-proxies.md §4):
|
|
# ln -sf ../sites-available/newsfeed.internal.conf /etc/nginx/sites-enabled/
|
|
|
|
upstream newsfeed_api {
|
|
server slartibartfast.kosherinata.internal:22672;
|
|
keepalive 16;
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl;
|
|
listen [::]:443 ssl;
|
|
http2 on;
|
|
server_name newsfeed.internal;
|
|
|
|
ssl_certificate /etc/nginx/tls/cert/newsfeed.internal.pem;
|
|
ssl_certificate_key /etc/nginx/tls/key/newsfeed.internal.pem;
|
|
ssl_protocols TLSv1.3;
|
|
ssl_trusted_certificate /etc/pki/ca-trust/source/anchors/root-internal.pem;
|
|
|
|
root /var/www/newsfeed;
|
|
index index.html;
|
|
|
|
# API + health probe → newsfeed-api on slartibartfast.
|
|
location /v1/ {
|
|
proxy_pass http://newsfeed_api;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
# For future WebSocket streaming endpoints, add the standard Upgrade/Connection
|
|
# map here (define `$connection_upgrade` once in http context).
|
|
}
|
|
location = /health {
|
|
proxy_pass http://newsfeed_api;
|
|
}
|
|
|
|
# Static SPA with client-side routing fallback.
|
|
location / {
|
|
try_files $uri $uri/ /index.html;
|
|
}
|
|
|
|
# Long-cache the fingerprinted asset bundle.
|
|
location /assets/ {
|
|
expires 1y;
|
|
add_header Cache-Control "public, immutable";
|
|
try_files $uri =404;
|
|
}
|
|
}
|