matitos
2a88f55689
The deploy job hard-failed without CRYPTO_API_TOKEN, and /api/ws (which skips Basic auth) relied on that token. Drop the requirement: the app now works with no token at all, matching the backend guard that was always a no-op when unset. When a token is configured it still protects /api and /api/ws; when it is not, /api/ws is as open as the rest of the API, which the Traefik Basic auth still guards for everything else. Adds tests for the tokenless API and WebSocket.
37 lines
1.2 KiB
Nginx Configuration File
37 lines
1.2 KiB
Nginx Configuration File
server {
|
|
listen 80;
|
|
server_name _;
|
|
root /usr/share/nginx/html;
|
|
index index.html;
|
|
|
|
location / {
|
|
try_files $uri $uri/ /index.html;
|
|
}
|
|
|
|
# WebSocket feed. Kept in its own block so the upgrade headers are only set
|
|
# here, and so the optional API token is injected server-side on the
|
|
# handshake (the browser cannot set headers on a WebSocket).
|
|
location /api/ws {
|
|
proxy_pass http://backend:8000;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_read_timeout 3600s;
|
|
proxy_send_timeout 3600s;
|
|
proxy_set_header ${API_TOKEN_HEADER} "${API_TOKEN}";
|
|
}
|
|
|
|
location /api/ {
|
|
proxy_pass http://backend:8000;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_read_timeout 3600s;
|
|
# Inject the optional API token server-side so the browser never sees it
|
|
# and the WebUI keeps working without any client changes.
|
|
proxy_set_header ${API_TOKEN_HEADER} "${API_TOKEN}";
|
|
}
|
|
}
|