Paul Payne
74570413fc
The karrot-frontend nginx template hardcodes Docker's DNS resolver (127.0.0.11) which doesn't exist in Kubernetes. Added a ConfigMap to override the template, removing the Docker DNS resolver by using a direct proxy_pass with no nginx variable (which would force runtime resolution). Also adds a README with usage instructions. Documents lessons learned in ADDING-APPS-NOTES.md: - Note 24: nginx Docker DNS resolver doesn't work in Kubernetes; any nginx variable in proxy_pass (including $request_uri) forces runtime DNS resolution requiring a resolver directive - Note 25: ConfigMap changes don't restart pods; subPath mounts never auto-update; always follow with kubectl rollout restart - Note 26: includeSelectors mismatch affects every deployment in an app — check all endpoints, not just the web-facing one Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
117 lines
3.2 KiB
YAML
117 lines
3.2 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: karrot-nginx-template
|
|
namespace: {{ .namespace }}
|
|
data:
|
|
default.conf.template: |
|
|
map $http_upgrade $connection_upgrade {
|
|
default upgrade;
|
|
'' close;
|
|
}
|
|
|
|
client_max_body_size ${FILE_UPLOAD_MAX_SIZE};
|
|
|
|
server {
|
|
|
|
listen ${LISTEN};
|
|
|
|
set_real_ip_from 10.0.0.0/8;
|
|
set_real_ip_from 172.16.0.0/12;
|
|
set_real_ip_from 192.168.0.0/16;
|
|
real_ip_header X-Forwarded-For;
|
|
|
|
root /usr/share/nginx/html;
|
|
|
|
location /assets {
|
|
expires max;
|
|
}
|
|
|
|
location /css {
|
|
expires max;
|
|
}
|
|
|
|
location /js {
|
|
expires max;
|
|
}
|
|
|
|
location /img {
|
|
expires max;
|
|
}
|
|
|
|
location /fonts {
|
|
expires max;
|
|
}
|
|
|
|
location / {
|
|
|
|
try_files $uri /index.html;
|
|
|
|
add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
|
|
add_header X-Content-Type-Options nosniff;
|
|
|
|
add_header Last-Modified $date_gmt;
|
|
add_header Cache-Control 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
|
|
|
|
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; connect-src 'self' https://nominatim.openstreetmap.org https://sentry.io https://*.ingest.sentry.io ${CSP_CONNECT_SRC} blob:; style-src 'self' 'unsafe-inline'; font-src 'self' data:; img-src 'self' https: data: blob:;";
|
|
|
|
if_modified_since off;
|
|
expires off;
|
|
etag off;
|
|
}
|
|
|
|
location /bundlesize.html {
|
|
add_header Content-Security-Policy "default-src 'self' 'unsafe-inline';";
|
|
add_header Cache-Control 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
|
|
}
|
|
|
|
location ~ ^\/(api(\-auth)?|docs|silk|static)\/ {
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $remote_addr;
|
|
proxy_set_header Host $http_host;
|
|
|
|
proxy_pass http://${BACKEND};
|
|
|
|
proxy_redirect off;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
proxy_set_header Sec-WebSocket-Extensions $http_sec_websocket_extensions;
|
|
proxy_set_header Sec-WebSocket-Key $http_sec_websocket_key;
|
|
proxy_set_header Sec-WebSocket-Protocol $http_sec_websocket_protocol;
|
|
proxy_set_header Sec-WebSocket-Version $http_sec_websocket_version;
|
|
}
|
|
|
|
location /media/ {
|
|
alias ${FILE_UPLOAD_DIR};
|
|
expires max;
|
|
}
|
|
|
|
location /media/tmp/ {
|
|
deny all;
|
|
return 404;
|
|
}
|
|
|
|
location ~ /media/conversation_message_attachment_(files|previews|thumbnails)/ {
|
|
deny all;
|
|
return 404;
|
|
}
|
|
|
|
location /uploads/ {
|
|
internal;
|
|
alias ${FILE_UPLOAD_DIR};
|
|
etag on;
|
|
}
|
|
|
|
location /community_proxy/ {
|
|
proxy_pass https://community.karrot.world/;
|
|
}
|
|
|
|
error_page 503 @maintenance;
|
|
|
|
location @maintenance {
|
|
try_files /maintenance.html =503;
|
|
}
|
|
|
|
}
|