96 lines
3.3 KiB
Nginx Configuration File
96 lines
3.3 KiB
Nginx Configuration File
# TLS terminates here. Keep the relay itself on a private loopback/container
|
|
# network and expose exactly one WebSocket path.
|
|
map $http_upgrade $connection_upgrade {
|
|
default upgrade;
|
|
'' close;
|
|
}
|
|
|
|
# Reject abusive handshake bursts before they consume relay CPU.
|
|
limit_req_zone $binary_remote_addr zone=relay_handshakes:10m rate=30r/m;
|
|
limit_conn_zone $binary_remote_addr zone=relay_connections:10m;
|
|
# The private federation listener sees one trusted CN stream-proxy source
|
|
# address for many overseas users. Bound that listener as an aggregate instead
|
|
# of applying the public per-client-IP ceiling to the shared backhaul.
|
|
limit_req_zone $server_port zone=relay_federation_handshakes:1m rate=3000r/m;
|
|
limit_conn_zone $server_port zone=relay_federation_connections:1m;
|
|
|
|
upstream openpencil_collab_relay {
|
|
server relay:8091;
|
|
keepalive 64;
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl http2;
|
|
server_name relay.example.com;
|
|
|
|
# A collaboration ticket can be up to 48 KiB. Bound but admit the
|
|
# Authorization request header on both public and federation listeners.
|
|
client_header_buffer_size 64k;
|
|
large_client_header_buffers 2 64k;
|
|
ssl_certificate /etc/nginx/tls/fullchain.pem;
|
|
ssl_certificate_key /etc/nginx/tls/privkey.pem;
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_session_tickets off;
|
|
server_tokens off;
|
|
|
|
location = /v1/tunnel {
|
|
access_log off;
|
|
limit_req zone=relay_handshakes burst=10 nodelay;
|
|
limit_conn relay_connections 8;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header Authorization $http_authorization;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
# The strict client fails closed unless the relay's 101 challenge is
|
|
# preserved end to end.
|
|
proxy_pass_header OpenPencil-Relay-Challenge;
|
|
proxy_buffering off;
|
|
proxy_read_timeout 43210s;
|
|
proxy_send_timeout 43210s;
|
|
proxy_pass http://openpencil_collab_relay;
|
|
}
|
|
|
|
location / {
|
|
return 404;
|
|
}
|
|
}
|
|
|
|
# Private inner-TLS terminator used only by the CN federation stream proxy.
|
|
# Publish/firewall this port exclusively on the trusted deployment network.
|
|
# Clients still negotiate TLS directly with this server through both L4 hops.
|
|
server {
|
|
listen 8444 ssl;
|
|
server_name relay.example.com;
|
|
|
|
client_header_buffer_size 64k;
|
|
large_client_header_buffers 2 64k;
|
|
ssl_certificate /etc/nginx/tls/fullchain.pem;
|
|
ssl_certificate_key /etc/nginx/tls/privkey.pem;
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_session_tickets off;
|
|
server_tokens off;
|
|
|
|
location = /v1/tunnel {
|
|
access_log off;
|
|
limit_req zone=relay_federation_handshakes burst=500 nodelay;
|
|
limit_conn relay_federation_connections 512;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header Authorization $http_authorization;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
proxy_pass_header OpenPencil-Relay-Challenge;
|
|
proxy_buffering off;
|
|
proxy_read_timeout 43210s;
|
|
proxy_send_timeout 43210s;
|
|
proxy_pass http://openpencil_collab_relay;
|
|
}
|
|
|
|
location / {
|
|
return 404;
|
|
}
|
|
}
|