update installation

2026-07-28 17:30:17 -05:00
parent 81f65b5173
commit 941ef0691f
14 changed files with 740 additions and 82 deletions
@@ -0,0 +1,83 @@
+# Testing-only HTTP reverse proxy. Production should use tls.conf.template.
+server_tokens off;
+reset_timedout_connection on;
+client_header_timeout 15s;
+client_body_timeout 60s;
+keepalive_timeout 30s;
+send_timeout 60s;
+
+limit_conn_zone $binary_remote_addr zone=per_address_connections:10m;
+limit_req_zone $binary_remote_addr zone=broker_requests:10m rate=20r/s;
+map $uri $gitea_login_client {
+    default "";
+    "/user/login" $binary_remote_addr;
+}
+limit_req_zone $gitea_login_client zone=gitea_login_requests:10m rate=10r/m;
+
+resolver 127.0.0.11 valid=30s;
+
+upstream gitea_backend {
+    zone gitea_backend 64k;
+    server gitea:3000 resolve;
+}
+
+server {
+    listen 80 default_server;
+    server_name _;
+    return 444;
+}
+
+server {
+    listen 80;
+    server_name ${BROKER_DOMAIN};
+
+    client_max_body_size 1100m;
+    limit_conn per_address_connections 30;
+    limit_req zone=broker_requests burst=40 nodelay;
+
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "DENY" always;
+    add_header Referrer-Policy "no-referrer" always;
+    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+
+    location / {
+        # Resolve at request time so Gitea-only bootstrap works before the
+        # broker container exists. Requests return 502 until broker setup ends.
+        set $broker_backend_url http://broker:8080;
+        proxy_pass $broker_backend_url;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto http;
+        proxy_connect_timeout 30s;
+        proxy_send_timeout 30m;
+        proxy_read_timeout 30m;
+        proxy_request_buffering off;
+        proxy_buffering off;
+    }
+}
+
+server {
+    listen 80;
+    server_name ${GITEA_DOMAIN};
+
+    client_max_body_size 1100m;
+    limit_conn per_address_connections 50;
+    limit_req zone=gitea_login_requests burst=10 nodelay;
+
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+
+    location / {
+        proxy_pass http://gitea_backend;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto http;
+        proxy_read_timeout 300s;
+    }
+}