mirror of
https://github.com/gadgethd/ukmesh.git
synced 2026-09-09 16:45:33 +00:00
gadgethd
1ebc496965
* Fix map node freshness consistency * Harden output, ingest, caches, and WebSocket limits * Enforce public visibility across derived data * Harden proxy and operator deployment boundary * Make owner grants authoritative and reconcile ACLs safely * Bound path, spam, and statistics analysis * Make link and coverage jobs crash-safe * Implement strategic security remediation * Fix production cutover configuration * Fix disabled viewshed worker health signal * Serve stale stats during background refresh * Retain stale stats through refresh windows * Bound analytics work to protect ingestion * Prioritize summary warmup over chart scans * Throttle path history rebuilds * Bound path history result memory * Stream path history aggregation * Give bounded path rebuild one CPU * Serve stale charts during bounded refresh * Prioritize startup stats before chart scans * Bound path history segment cardinality * Pin path rebuild context to privacy generation * Self-host original frontend fonts * Allow bounded path rebuild to complete * Improve live map UI and low-latency group feed - Dock node details on the right with selection highlight and collapsible layers - Add node legend, 24h activity sparkline, copy-link, and layout/overlap fixes - Keep all repeaters visible during Live Path focus - Send GroupText feed packets immediately over WebSocket (no batch delay) - Cache expensive stats/observer activity more aggressively to protect ingest - Remove stale local planning/audit markdown from the tree * fix(ci): supply OPERATOR_SITE_TOKEN for compose validation Workers/Compose CI failed because docker-compose requires OPERATOR_SITE_TOKEN. Add CI placeholders for that and MQTT_PASSWORD.
103 lines
3.2 KiB
Plaintext
103 lines
3.2 KiB
Plaintext
geo $mesh_trusted_edge {
|
|
default 0;
|
|
172.30.0.20 1;
|
|
172.30.0.21 1;
|
|
}
|
|
|
|
map "$mesh_trusted_edge:$http_cf_connecting_ip" $mesh_client_ip {
|
|
default $remote_addr;
|
|
~^1:([0-9A-Fa-f:.]+)$ $1;
|
|
}
|
|
|
|
server {
|
|
listen 80;
|
|
root /usr/share/nginx/html;
|
|
index index.html;
|
|
resolver 127.0.0.11 valid=10s ipv6=off;
|
|
include /etc/nginx/snippets/security-headers.conf;
|
|
|
|
# Gzip compression — critical for large API responses (coverage ~26 MB → ~2-3 MB)
|
|
gzip on;
|
|
gzip_vary on;
|
|
gzip_proxied any;
|
|
gzip_comp_level 6;
|
|
gzip_types text/plain text/css text/xml application/json application/javascript application/rss+xml application/atom+xml image/svg+xml;
|
|
gzip_min_length 256;
|
|
|
|
# Operator endpoints are never part of the public website origin.
|
|
location ~ ^/(local-api|backend|ml-path-learner)(/|$) {
|
|
return 404;
|
|
}
|
|
|
|
# Proxy API calls through to the app service so live stats work
|
|
location /api/ {
|
|
set $backend_api_upstream http://backend:3000;
|
|
proxy_pass $backend_api_upstream;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $mesh_client_ip;
|
|
proxy_set_header X-Forwarded-For $mesh_client_ip;
|
|
}
|
|
|
|
location = /readyz {
|
|
set $backend_ready_upstream http://backend:3000;
|
|
proxy_pass $backend_ready_upstream;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $mesh_client_ip;
|
|
proxy_set_header X-Forwarded-For $mesh_client_ip;
|
|
}
|
|
|
|
# Proxy WebSocket connections to backend
|
|
location /ws/ {
|
|
set $backend_ws_upstream http://backend:3000;
|
|
proxy_pass $backend_ws_upstream;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $mesh_client_ip;
|
|
proxy_set_header X-Forwarded-For $mesh_client_ip;
|
|
proxy_read_timeout 86400;
|
|
}
|
|
location /ws {
|
|
set $backend_ws_upstream http://backend:3000;
|
|
proxy_pass $backend_ws_upstream;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_read_timeout 86400;
|
|
}
|
|
|
|
# Static SEO files — serve directly, not via SPA fallback
|
|
location = /robots.txt {
|
|
try_files $uri =404;
|
|
}
|
|
location = /sitemap.xml {
|
|
include /etc/nginx/snippets/security-headers.conf;
|
|
add_header Content-Type application/xml;
|
|
try_files $uri =404;
|
|
}
|
|
|
|
# SPA fallback — all routes serve index.html
|
|
location / {
|
|
include /etc/nginx/snippets/security-headers.conf;
|
|
add_header Cache-Control "no-cache, no-store, must-revalidate";
|
|
try_files $uri $uri/ /index.html;
|
|
}
|
|
|
|
location /assets/ {
|
|
include /etc/nginx/snippets/security-headers.conf;
|
|
expires 1y;
|
|
add_header Cache-Control "public, immutable";
|
|
try_files $uri =404;
|
|
}
|
|
|
|
location = /index.html {
|
|
include /etc/nginx/snippets/security-headers.conf;
|
|
add_header Cache-Control "no-cache, no-store, must-revalidate";
|
|
}
|
|
}
|