Tom FluxandClaude Opus 5
00d3cb0e61
The nginx block is plain http; certbot adds the TLS server block and the redirect itself. It sets X-Forwarded-Proto, which is load-bearing: the app compares the browser's Origin against the URL it believes it is serving, and without that header it thinks it is on http while the browser says https, decides every save is cross-site and drops the session. Upstream's README is kept as README.nullboard.md. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UU1vyTHj3uE9PJYSxRxwkU
40 lines
1.5 KiB
Plaintext
40 lines
1.5 KiB
Plaintext
# ValidBoard — nginx site
|
|
#
|
|
# sudo cp deploy/board.jihakuz.xyz.conf /etc/nginx/sites-available/board.jihakuz.xyz
|
|
# sudo ln -s /etc/nginx/sites-available/board.jihakuz.xyz /etc/nginx/sites-enabled/
|
|
# sudo nginx -t && sudo systemctl reload nginx
|
|
# sudo certbot --nginx -d board.jihakuz.xyz
|
|
#
|
|
# Plain http only, on purpose — certbot adds the 443 server block, the
|
|
# certificate lines and the http->https redirect itself.
|
|
|
|
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
|
|
server_name board.jihakuz.xyz;
|
|
|
|
# ValidBoard rejects cross-site writes by comparing the browser's Origin
|
|
# header against the URL it thinks it is serving. It builds that URL from
|
|
# the headers below, so without X-Forwarded-Proto it will believe it is on
|
|
# http:// while the browser says https:// — and every save comes back 403
|
|
# the moment certbot switches the site to TLS.
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
|
# The whole board set is inlined into the page at load, so it is worth
|
|
# compressing; it's all text.
|
|
gzip on;
|
|
gzip_types text/html application/json application/javascript text/css;
|
|
gzip_min_length 1024;
|
|
|
|
# Matches the server's own 2 MB per-item cap, with room for the envelope.
|
|
client_max_body_size 4m;
|
|
|
|
location / {
|
|
proxy_pass http://127.0.0.1:8047;
|
|
}
|
|
}
|