a39406c12b
Add production deployment configs for the collab relay and locator: region-split compose (CN/global), direct nginx gateways and location maps, the CN docker-user firewall install/verify/validate tooling and systemd unit, and an SoftHSM-backed locator variant. Extend the collab security/deployment boundary checks to cover the new artifacts. The CN application host address is a placeholder (10.0.0.10); substitute the real private address at deploy time.
32 lines
1 KiB
Plaintext
32 lines
1 KiB
Plaintext
# Include inside a regional application TLS server after including
|
|
# nginx-http-limits.conf and the matching Global-host or CN-front-gateway
|
|
# `nginx-http-direct*.conf` once at `http` scope. This application-host
|
|
# variant intentionally has no /healthz or catch-all location.
|
|
|
|
location = /v1/locator {
|
|
if ($request_uri != "/v1/locator") {
|
|
return 404;
|
|
}
|
|
if ($http_host = "") {
|
|
return 400;
|
|
}
|
|
|
|
access_log off;
|
|
limit_req zone=openpencil_locator_per_source burst=20 nodelay;
|
|
limit_req_status 429;
|
|
limit_conn openpencil_locator_connections 16;
|
|
limit_conn_status 429;
|
|
client_max_body_size 191;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Connection close;
|
|
proxy_set_header Host $http_host;
|
|
proxy_set_header Authorization $http_authorization;
|
|
proxy_set_header Content-Type $http_content_type;
|
|
proxy_set_header Accept $http_accept;
|
|
proxy_pass http://openpencil_collab_locator/v1/locator;
|
|
proxy_connect_timeout 5s;
|
|
proxy_send_timeout 10s;
|
|
proxy_read_timeout 10s;
|
|
proxy_buffering off;
|
|
}
|