Compare commits
No commits in common. "c24c6156dcfe942cb8e5e069c14ad87ece1bf0ab" and "5571768706cf0e79c394a459b04abfc2a6e9206a" have entirely different histories.
c24c6156dc
...
5571768706
3 changed files with 2 additions and 35 deletions
|
|
@ -62,18 +62,6 @@ app.use(express.json({ limit: '50mb' }));
|
||||||
// Trust the reverse proxy only when explicitly told to (production HTTPS).
|
// Trust the reverse proxy only when explicitly told to (production HTTPS).
|
||||||
if (process.env.TRUST_PROXY === 'true') app.set('trust proxy', 1);
|
if (process.env.TRUST_PROXY === 'true') app.set('trust proxy', 1);
|
||||||
|
|
||||||
// HSTS — once a browser has seen this header over HTTPS for dragonflight.live,
|
|
||||||
// it auto-upgrades every future http:// request to https:// before hitting the
|
|
||||||
// wire. Cookies are Secure-only (below) and the CORS allowlist rejects HTTP,
|
|
||||||
// so without HSTS a user who lands on http:// silently can't log in.
|
|
||||||
// Only emit on actual HTTPS responses; req.secure honors trust proxy + X-Forwarded-Proto.
|
|
||||||
if (process.env.AUTH_ENABLED === 'true') {
|
|
||||||
app.use((req, res, next) => {
|
|
||||||
if (req.secure) res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
|
|
||||||
next();
|
|
||||||
});
|
|
||||||
}
|
|
||||||
|
|
||||||
// Hard-fail when production-mode auth has no stable session secret. Without
|
// Hard-fail when production-mode auth has no stable session secret. Without
|
||||||
// this, express-session falls back to an in-memory random secret which
|
// this, express-session falls back to an in-memory random secret which
|
||||||
// invalidates every session on restart and breaks multi-node deployments.
|
// invalidates every session on restart and breaks multi-node deployments.
|
||||||
|
|
|
||||||
|
|
@ -1,16 +1,3 @@
|
||||||
# Map for proper WebSocket upgrade handling on the proxied locations below.
|
|
||||||
# Without this, hardcoding `proxy_set_header Connection "upgrade"` puts nginx
|
|
||||||
# into tunnel-mode for every request — which silently drops response headers
|
|
||||||
# including Set-Cookie. That broke session-cookie auth on /api/v1/auth/login:
|
|
||||||
# mam-api was issuing the cookie, web-ui's proxy was eating it before it
|
|
||||||
# reached the browser. With this map, Connection is only set to "upgrade"
|
|
||||||
# when the client actually requested an Upgrade (real WebSocket); otherwise
|
|
||||||
# it's "close" and the response flows through normally.
|
|
||||||
map $http_upgrade $connection_upgrade {
|
|
||||||
default upgrade;
|
|
||||||
'' close;
|
|
||||||
}
|
|
||||||
|
|
||||||
server {
|
server {
|
||||||
listen 80;
|
listen 80;
|
||||||
server_name _;
|
server_name _;
|
||||||
|
|
@ -67,7 +54,7 @@ server {
|
||||||
proxy_pass $api_upstream;
|
proxy_pass $api_upstream;
|
||||||
proxy_http_version 1.1;
|
proxy_http_version 1.1;
|
||||||
proxy_set_header Upgrade $http_upgrade;
|
proxy_set_header Upgrade $http_upgrade;
|
||||||
proxy_set_header Connection $connection_upgrade;
|
proxy_set_header Connection "upgrade";
|
||||||
proxy_set_header Host $host;
|
proxy_set_header Host $host;
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
proxy_set_header X-Real-IP $remote_addr;
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
|
@ -87,7 +74,7 @@ server {
|
||||||
proxy_pass $capture_upstream;
|
proxy_pass $capture_upstream;
|
||||||
proxy_http_version 1.1;
|
proxy_http_version 1.1;
|
||||||
proxy_set_header Upgrade $http_upgrade;
|
proxy_set_header Upgrade $http_upgrade;
|
||||||
proxy_set_header Connection $connection_upgrade;
|
proxy_set_header Connection "upgrade";
|
||||||
proxy_set_header Host $host;
|
proxy_set_header Host $host;
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
proxy_set_header X-Real-IP $remote_addr;
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
|
|
||||||
|
|
@ -2,14 +2,6 @@
|
||||||
<html lang="en">
|
<html lang="en">
|
||||||
<head>
|
<head>
|
||||||
<meta charset="utf-8" />
|
<meta charset="utf-8" />
|
||||||
<script>
|
|
||||||
// Force HTTPS on the public domain — Secure cookies and the CORS allowlist
|
|
||||||
// both refuse HTTP, so an http:// landing silently breaks login. Local /
|
|
||||||
// LAN hostnames keep whatever protocol they came in on.
|
|
||||||
if (location.protocol === 'http:' && location.hostname === 'dragonflight.live') {
|
|
||||||
location.replace('https:' + location.href.substring(5));
|
|
||||||
}
|
|
||||||
</script>
|
|
||||||
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
||||||
<title>Dragonflight · Wild Dragon Broadcast</title>
|
<title>Dragonflight · Wild Dragon Broadcast</title>
|
||||||
<link rel="preconnect" href="https://fonts.googleapis.com" />
|
<link rel="preconnect" href="https://fonts.googleapis.com" />
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue