a39406c12b
Add production deployment configs for the collab relay and locator: region-split compose (CN/global), direct nginx gateways and location maps, the CN docker-user firewall install/verify/validate tooling and systemd unit, and an SoftHSM-backed locator variant. Extend the collab security/deployment boundary checks to cover the new artifacts. The CN application host address is a placeholder (10.0.0.10); substitute the real private address at deploy time.
17 lines
525 B
Plaintext
17 lines
525 B
Plaintext
# Include exactly once in the Nginx `http` block when the relay paths share an
|
|
# application TLS virtual host. The standalone nginx.conf already declares
|
|
# equivalent resources and must not be combined with this snippet.
|
|
|
|
map $http_upgrade $connection_upgrade {
|
|
default upgrade;
|
|
'' close;
|
|
}
|
|
|
|
limit_req_zone $binary_remote_addr zone=relay_handshakes:10m rate=30r/m;
|
|
limit_conn_zone $binary_remote_addr zone=relay_connections:10m;
|
|
|
|
upstream openpencil_collab_relay {
|
|
server 127.0.0.1:8091;
|
|
keepalive 64;
|
|
}
|