gortium/openconcho
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(docker): header-driven /api reverse proxy in nginx

Browse Source
This commit is contained in:
Offending Commit
2026-06-02 11:57:55 -05:00
parent b29fa240a6
commit 753c978f56
1 changed files with 22 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
docker/nginx.conf.template
View File

@@ -1,6 +1,6 @@
# OpenConcho — nginx site config (envsubst template). # OpenConcho — nginx site config.
# The nginx image renders ${HONCHO_UPSTREAM} from the environment at start. # Serves the React SPA and header-driven same-origin /api proxy to Honcho.
# Serves the React SPA and reverse-proxies the Honcho API under the same origin. # The browser sends X-Honcho-Upstream per request; nginx forwards server-side (no browser CORS).
server { server {
listen 8080; listen 8080;
@@ -12,23 +12,27 @@ server {
# Don't leak the nginx version. # Don't leak the nginx version.
server_tokens off; server_tokens off;
# Same-origin reverse proxy to Honcho so the browser never sees a # Resolver required for per-request DNS when proxy_pass targets a runtime variable.
# cross-origin request (no CORS). The variable + Docker resolver let nginx
# start even when the upstream isn't resolvable yet, re-resolving per request.
resolver 127.0.0.11 ipv6=off valid=10s; resolver 127.0.0.11 ipv6=off valid=10s;
set $honcho_upstream "${HONCHO_UPSTREAM}";
# `^~` so these win over the static-asset regex below. # Header-driven same-origin proxy: the browser names the Honcho upstream per
location ^~ /v3/ { # request via X-Honcho-Upstream, so the browser never makes a cross-origin call.
proxy_pass $honcho_upstream$request_uri; # $allow_upstream is provided by the allowlist map in conf.d (entrypoint-rendered).
proxy_set_header Host $host; location ^~ /api/ {
proxy_set_header X-Real-IP $remote_addr; set $upstream $http_x_honcho_upstream;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; if ($upstream = "") {
proxy_set_header X-Forwarded-Proto $scheme; add_header X-Honcho-Proxy-Reject "no-upstream" always;
} return 421;
location = /health { }
proxy_pass $honcho_upstream/health; if ($allow_upstream = 0) {
proxy_set_header Host $host; add_header X-Honcho-Proxy-Reject "allowlist" always;
return 403;
}
rewrite ^/api/(.*)$ /$1 break;
proxy_pass $upstream;
proxy_ssl_server_name on;
proxy_set_header Host $proxy_host;
proxy_set_header X-Honcho-Upstream "";
} }
# Runtime config — regenerated per container start, must never be cached. # Runtime config — regenerated per container start, must never be cached.