Codex Local
bf1233d5df
ci / verify (push) Canceled after 0s
Add customer and operator login, BLE provisioning, device fleet controls, call memory, memoir generation, and refreshed family and maintenance portals. Include API contracts, migrations, firmware sources, tests, assets, and deployment documentation.
126 lines
3.7 KiB
Nginx Configuration File
126 lines
3.7 KiB
Nginx Configuration File
server {
|
|
listen 80;
|
|
location ^~ /.well-known/acme-challenge/ { root /var/www/acme; }
|
|
server_name _;
|
|
# First-boot clock bootstrap only. The response is authenticated by TIME1.
|
|
location = /api/v1/device/time-challenges {
|
|
limit_except POST { deny all; }
|
|
client_max_body_size 8k;
|
|
resolver 127.0.0.11 ipv6=off valid=10s;
|
|
set $clock_backend http://api:8080;
|
|
proxy_pass $clock_backend;
|
|
proxy_set_header Host $http_host;
|
|
proxy_set_header X-Forwarded-Proto http;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_buffering off;
|
|
}
|
|
location / {
|
|
return 301 https://82.157.201.114$request_uri;
|
|
}
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl;
|
|
server_name 82.157.201.114;
|
|
server_tokens off;
|
|
client_max_body_size 256m;
|
|
|
|
ssl_certificate /etc/letsencrypt/live/82.157.201.114/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/82.157.201.114/privkey.pem;
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_session_cache shared:SSL:10m;
|
|
ssl_session_timeout 1d;
|
|
|
|
add_header Strict-Transport-Security "max-age=31536000" always;
|
|
|
|
resolver 127.0.0.11 ipv6=off valid=10s;
|
|
set $api_backend http://api:8080;
|
|
set $callbacks_backend http://callbacks:8081;
|
|
set $keycloak_backend http://keycloak:8080;
|
|
set $minio_backend http://minio:9000;
|
|
set $web_backend http://web:8080;
|
|
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $http_host;
|
|
proxy_set_header X-Forwarded-Host $http_host;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Forwarded-Port $server_port;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
|
|
location /api/ {
|
|
proxy_pass $api_backend;
|
|
proxy_buffering off;
|
|
proxy_read_timeout 3600s;
|
|
}
|
|
|
|
location /device/ {
|
|
proxy_pass $api_backend;
|
|
proxy_buffering off;
|
|
}
|
|
|
|
location /f/ {
|
|
proxy_pass $api_backend;
|
|
proxy_buffering off;
|
|
proxy_request_buffering off;
|
|
proxy_read_timeout 15m;
|
|
send_timeout 15m;
|
|
access_log off;
|
|
}
|
|
|
|
# The voice provider can call only this signed, conversation-scoped tool.
|
|
# Do not expose the rest of the /internal namespace.
|
|
location = /internal/v1/tools/memory-search {
|
|
proxy_pass $api_backend;
|
|
proxy_buffering off;
|
|
proxy_request_buffering off;
|
|
}
|
|
|
|
location /callbacks/ {
|
|
proxy_pass $callbacks_backend;
|
|
proxy_buffering off;
|
|
}
|
|
|
|
location /realms/ {
|
|
proxy_pass $keycloak_backend;
|
|
}
|
|
|
|
location /resources/ {
|
|
proxy_pass $keycloak_backend;
|
|
}
|
|
|
|
location /private-exports/ {
|
|
proxy_pass $minio_backend;
|
|
proxy_request_buffering off;
|
|
proxy_buffering off;
|
|
}
|
|
|
|
# Dify workflow console; authenticated by its own console session.
|
|
location = /dify { return 302 /apps; }
|
|
# Keep Dify session refresh separate from the platform OIDC callback.
|
|
location = /auth/refresh {
|
|
proxy_pass http://story-dify-nginx:80;
|
|
proxy_buffering off;
|
|
proxy_read_timeout 900s;
|
|
}
|
|
location ~ ^/(?:apps|app|signin|init|install|reset-password|activate|datasets|tools|plugins|explore|snippets|agents|_next|logo|images|vs|marketplace|in-site-message|screenshots|education)(?:/|$) {
|
|
proxy_pass http://story-dify-nginx:80;
|
|
proxy_buffering off;
|
|
proxy_read_timeout 900s;
|
|
}
|
|
location ^~ /console/api {
|
|
proxy_pass http://story-dify-nginx:80;
|
|
proxy_buffering off;
|
|
proxy_read_timeout 900s;
|
|
}
|
|
location ^~ /v1/ {
|
|
proxy_pass http://story-dify-nginx:80;
|
|
proxy_buffering off;
|
|
proxy_read_timeout 900s;
|
|
}
|
|
|
|
location / {
|
|
proxy_pass $web_backend;
|
|
}
|
|
}
|