mirror of
git://f0xx.org/ac/ac-deploy
synced 2026-07-29 04:19:00 +03:00
deploy: favicon, nuevo-player, ac-ms-broadcast, nginx notify/monitor/broadcast
- favicon.ico (32px) + apple-touch-icon.ico (180px) added to composed backend seed
- layout.php: add <link rel="icon"> and <link rel="apple-touch-icon"> in <head>
- nuevo-player (Video.js + Nuevo licensed plugin) into assets/vendor/nuevo-player/
- THIRD_PARTY_LICENSES.md: add Nuevo Player (commercial) + TipTap (MIT) entries
- apps-port80.conf: full rewrite with all live fixes merged in:
* map $http_upgrade $connection_upgrade (WebSocket upgrade)
* 2FA location regex extended: api/two-factor
* grafana-auth-check internal endpoint + @monitor_login_redirect
* Grafana proxy (cast04:3000) + Alertmanager proxy (cast04:9093)
* broadcast admin path /app/androidcast_project/broadcast/ (auth_request gated)
* notify.f0xx.org server block: public /m/{slug} landing + API
* favicon.ico at server root
- deploy-ac-broadcast.sh: new app-phase script (DB schema, user, worker, rsync)
- populate_lab_setup.sh: add deploy-ac-broadcast.sh to run_phase_app
Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Anton Afanasyeu
@@ -1,18 +1,34 @@
|
||||
# Full androidcast vhost for Alpine BE — listen 80 only.
|
||||
# FE (apps.f0xx.org / s.f0xx.org) proxies here: cast01–03 cluster :80
|
||||
# FE (apps.f0xx.org / s.f0xx.org / notify.f0xx.org) proxies here: cast01–03 cluster :80
|
||||
# Port 8089 is a different service (e.g. Janus) — not this vhost.
|
||||
|
||||
map $http_upgrade $connection_upgrade {
|
||||
default upgrade;
|
||||
'' close;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 80 default_server;
|
||||
listen [::]:80 default_server;
|
||||
|
||||
# OTA v0 static tree — devices fetch https://apps.f0xx.org/v0/ota/channel/stable.json
|
||||
# Populate: builder auto_deploy, or rsync out/ota/v0/ → .../ota-artifacts/v0/
|
||||
location ^~ /v0/ota/ {
|
||||
alias /var/www/localhost/htdocs/apps/app/androidcast_project/ota-artifacts/v0/ota/;
|
||||
add_header Cache-Control "public, max-age=60";
|
||||
}
|
||||
|
||||
# Favicon — served from hub root (shared by all sub-apps via explicit <link> tags)
|
||||
location = /favicon.ico {
|
||||
alias /var/www/localhost/htdocs/apps/app/androidcast_project/favicon.ico;
|
||||
access_log off;
|
||||
expires 7d;
|
||||
}
|
||||
location = /apple-touch-icon.ico {
|
||||
alias /var/www/localhost/htdocs/apps/app/androidcast_project/apple-touch-icon.ico;
|
||||
access_log off;
|
||||
expires 7d;
|
||||
}
|
||||
|
||||
location = /app/androidcast_project {
|
||||
return 301 /app/androidcast_project/;
|
||||
}
|
||||
@@ -28,8 +44,9 @@ server {
|
||||
rewrite ^ /app/androidcast_project/index.php last;
|
||||
}
|
||||
|
||||
# Shared session auth at project root (not under /issues/) — composed ac/* backend
|
||||
location ~ ^/app/androidcast_project/(login|logout|register|two-factor|verify-email)(/|$) {
|
||||
# Shared session auth at project root — composed ac/* backend
|
||||
# Includes 2FA cross-device and polling endpoints
|
||||
location ~ ^/app/androidcast_project/(login|logout|register|two-factor|verify-email|api/two-factor)(/|$) {
|
||||
include fastcgi_params;
|
||||
fastcgi_pass 127.0.0.1:9000;
|
||||
fastcgi_param SCRIPT_FILENAME /var/www/ac/composed/backend/public/index.php;
|
||||
@@ -48,7 +65,7 @@ server {
|
||||
return 301 /app/androidcast_project/graphs/;
|
||||
}
|
||||
|
||||
# --- Target paths (SPEC): /issues/ served from composed ac/* backend ---
|
||||
# --- /issues/ served from composed ac/* backend ---
|
||||
location = /app/androidcast_project/issues {
|
||||
return 301 /app/androidcast_project/issues/;
|
||||
}
|
||||
@@ -140,6 +157,77 @@ server {
|
||||
fastcgi_read_timeout 1800s;
|
||||
}
|
||||
|
||||
# ── grafana-auth-check: internal auth_request endpoint ───────────────────
|
||||
location = /app/androidcast_project/api/grafana-auth-check.php {
|
||||
internal;
|
||||
include fastcgi_params;
|
||||
fastcgi_pass 127.0.0.1:9000;
|
||||
fastcgi_param SCRIPT_FILENAME /var/www/ac/composed/backend/public/api/grafana-auth-check.php;
|
||||
fastcgi_param SCRIPT_NAME /app/androidcast_project/api/grafana-auth-check.php;
|
||||
fastcgi_param REQUEST_URI $request_uri;
|
||||
fastcgi_param HTTP_COOKIE $http_cookie;
|
||||
}
|
||||
|
||||
location @monitor_login_redirect {
|
||||
return 302 /app/androidcast_project/login?redirect=$request_uri;
|
||||
}
|
||||
|
||||
# ── Grafana at cast04:3000 ────────────────────────────────────────────────
|
||||
location = /app/androidcast_project/monitor {
|
||||
return 301 /app/androidcast_project/monitor/;
|
||||
}
|
||||
location /app/androidcast_project/monitor/ {
|
||||
auth_request /app/androidcast_project/api/grafana-auth-check.php;
|
||||
auth_request_set $grafana_user $upstream_http_x_webauth_user;
|
||||
error_page 401 = @monitor_login_redirect;
|
||||
proxy_pass http://10.7.16.239:3000/;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-WEBAUTH-USER $grafana_user;
|
||||
proxy_http_version 1.1;
|
||||
proxy_read_timeout 300;
|
||||
proxy_send_timeout 300;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection $connection_upgrade;
|
||||
}
|
||||
|
||||
# ── Alertmanager at cast04:9093 ───────────────────────────────────────────
|
||||
location = /app/androidcast_project/alertmanager {
|
||||
return 301 /app/androidcast_project/alertmanager/;
|
||||
}
|
||||
location /app/androidcast_project/alertmanager/ {
|
||||
auth_request /app/androidcast_project/api/grafana-auth-check.php;
|
||||
auth_request_set $grafana_user $upstream_http_x_webauth_user;
|
||||
error_page 401 = @monitor_login_redirect;
|
||||
proxy_pass http://10.7.16.239:9093/;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_http_version 1.1;
|
||||
proxy_read_timeout 120;
|
||||
proxy_send_timeout 120;
|
||||
}
|
||||
|
||||
# ── Broadcast admin dashboard (/app/androidcast_project/broadcast/) ───────
|
||||
location = /app/androidcast_project/broadcast {
|
||||
return 301 /app/androidcast_project/broadcast/;
|
||||
}
|
||||
location /app/androidcast_project/broadcast/ {
|
||||
auth_request /app/androidcast_project/api/grafana-auth-check.php;
|
||||
auth_request_set $auth_user $upstream_http_x_webauth_user;
|
||||
error_page 401 = @monitor_login_redirect;
|
||||
include fastcgi_params;
|
||||
fastcgi_pass 127.0.0.1:9000;
|
||||
fastcgi_param SCRIPT_FILENAME /var/www/ac/broadcast/public/index.php;
|
||||
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
|
||||
fastcgi_param REQUEST_URI $request_uri;
|
||||
fastcgi_param HTTP_COOKIE $http_cookie;
|
||||
fastcgi_param HTTP_AUTHORIZATION $http_authorization;
|
||||
}
|
||||
|
||||
# --- Gitea web UI (lab browse; mirrors configured separately) ---
|
||||
location = /app/androidcast_project/git {
|
||||
return 301 /app/androidcast_project/git/;
|
||||
@@ -164,3 +252,39 @@ server {
|
||||
fastcgi_pass 127.0.0.1:9000;
|
||||
}
|
||||
}
|
||||
|
||||
# ── notify.f0xx.org — Broadcast public landing pages ─────────────────────────
|
||||
# CNAME: notify.f0xx.org → apps.f0xx.org → cluster (cast01–03)
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name notify.f0xx.org;
|
||||
|
||||
root /var/www/ac/broadcast/public;
|
||||
index index.php;
|
||||
|
||||
location = /favicon.ico {
|
||||
alias /var/www/localhost/htdocs/apps/app/androidcast_project/favicon.ico;
|
||||
access_log off;
|
||||
expires 7d;
|
||||
}
|
||||
|
||||
location / {
|
||||
try_files $uri /index.php?$query_string;
|
||||
}
|
||||
|
||||
location ~ \.php$ {
|
||||
include fastcgi_params;
|
||||
fastcgi_pass 127.0.0.1:9000;
|
||||
fastcgi_param SCRIPT_FILENAME /var/www/ac/broadcast/public/index.php;
|
||||
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
|
||||
fastcgi_param REQUEST_URI $request_uri;
|
||||
fastcgi_param HTTP_COOKIE $http_cookie;
|
||||
fastcgi_param HTTP_AUTHORIZATION $http_authorization;
|
||||
}
|
||||
|
||||
location ~* \.(js|css|png|jpg|ico|woff2?)$ {
|
||||
expires 7d;
|
||||
add_header Cache-Control "public";
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user