matitos/crypto_trading
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Serve /api/ws without Basic auth so the live feed connects
CI/CD / backend (pull_request) Successful in 5m58s
Details
CI/CD / frontend (pull_request) Successful in 5m3s
Details
CI/CD / build (pull_request) Skipped
Details
CI/CD / deploy (pull_request) Skipped
Details
CI/CD / cleanup (pull_request) Skipped
Details

Browse Source 
Browsers don't reliably replay Basic-auth credentials on a WebSocket upgrade,
so the dashboard's live feed was stuck on "reconnecting" (only the 5s REST
poll worked). Give /api/ws a higher-priority Traefik router that skips Basic
auth; the backend still requires API_TOKEN, which nginx injects on the
handshake. The deploy now fails closed unless CRYPTO_API_TOKEN is set.

Also: split the nginx /api/ws block so upgrade headers are only set there, and
add reconnect backoff (2s -> 30s) so a failing socket stops hammering.
This commit is contained in:
matitos committed 2026-09-19 12:52:06 +00:00
1 parent 97fbd5901e
commit 3e19612cc0
7 files changed
+101 -4
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docker-compose.yml
+12
View File
@@ -96,6 +96,18 @@ services:
# fallback). A per-source rate limit reduces credential brute-forcing.
- "traefik.http.routers.crypto-trading.middlewares=crypto-trading-auth@docker,crypto-trading-sec@docker,crypto-trading-authlimit@docker"
- "traefik.http.middlewares.crypto-trading-auth.basicauth.users=${CRYPTO_FRONTEND_AUTH_USERS:?CRYPTO_FRONTEND_AUTH_USERS is required (htpasswd string, e.g. htpasswd -nbB user pass)}"
# Browsers do not reliably replay Basic-auth credentials on a WebSocket
# upgrade, which left the live feed stuck "reconnecting". Give /api/ws its
# own higher-priority router that skips Basic auth; the backend still
# requires the API token, which nginx injects server-side. When no API
# token is configured this path is unauthenticated, so only use it on a
# trusted network.
- "traefik.http.routers.crypto-trading-ws.rule=Host(`crypto.${BASE_DOMAIN:-matitos.org}`) && PathPrefix(`/api/ws`)"
- "traefik.http.routers.crypto-trading-ws.entrypoints=websecure"
- "traefik.http.routers.crypto-trading-ws.tls.certresolver=myresolvercd"
- "traefik.http.routers.crypto-trading-ws.priority=100"
- "traefik.http.routers.crypto-trading-ws.middlewares=crypto-trading-sec@docker,crypto-trading-authlimit@docker"
- "traefik.http.routers.crypto-trading-ws.service=crypto-trading"
- "traefik.http.middlewares.crypto-trading-authlimit.ratelimit.average=${CRYPTO_AUTH_RATE_LIMIT_AVERAGE:-10}"
- "traefik.http.middlewares.crypto-trading-authlimit.ratelimit.burst=${CRYPTO_AUTH_RATE_LIMIT_BURST:-5}"
- "traefik.http.middlewares.crypto-trading-sec.headers.stsSeconds=31536000"