clawbot
64805f841d
check / check (push) Successful in 10s
The root Dockerfile builds the only image; Dockerfile.backend is gone. Its stages: lint, a Go stage that runs the tests and builds netwatch-server, the node stage, and an nginx runtime. nginx serves dist/ on 8080 and proxies /api/ and /.well-known/healthcheck to the backend on 127.0.0.1:8081. bin/entrypoint.sh starts both, turns TERM or INT into a stop of both, and exits non-zero when either exits on its own. The backend runs as user netwatch and keeps reports on the /data volume. New setting BIND_ADDRESS (empty: every interface). STOPSIGNAL is SIGTERM, since the nginx image's SIGQUIT would miss the entrypoint. script/docker is the org model verbatim. Model: opus-5-5
48 lines
1.4 KiB
Nginx Configuration File
48 lines
1.4 KiB
Nginx Configuration File
server {
|
|
listen 8080;
|
|
server_name _;
|
|
|
|
root /usr/share/nginx/html;
|
|
index index.html;
|
|
|
|
# Trust RFC1918 reverse proxies for X-Forwarded-For
|
|
set_real_ip_from 10.0.0.0/8;
|
|
set_real_ip_from 172.16.0.0/12;
|
|
set_real_ip_from 192.168.0.0/16;
|
|
real_ip_header X-Forwarded-For;
|
|
real_ip_recursive on;
|
|
|
|
# Access log to stdout (Docker best practice)
|
|
access_log /dev/stdout combined;
|
|
error_log /dev/stderr warn;
|
|
|
|
location / {
|
|
try_files $uri $uri/ /index.html;
|
|
}
|
|
|
|
# Cache static assets aggressively
|
|
location /assets/ {
|
|
expires 1y;
|
|
add_header Cache-Control "public, immutable";
|
|
}
|
|
|
|
# netwatch-server, the Go backend, runs in the same container and
|
|
# listens on loopback only: bin/entrypoint.sh starts it on
|
|
# 127.0.0.1:8081. These headers go with every request passed to it.
|
|
# X-Forwarded-For carries only the client address, as resolved by
|
|
# the real IP settings above, and not the chain the request came
|
|
# with: the backend takes the first entry, which a client can write.
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $remote_addr;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
|
location /api/ {
|
|
proxy_pass http://127.0.0.1:8081;
|
|
}
|
|
|
|
location = /.well-known/healthcheck {
|
|
proxy_pass http://127.0.0.1:8081;
|
|
}
|
|
}
|