mirror of
git://f0xx.org/ac/ac-deploy
synced 2026-07-29 06:58:52 +03:00
b8bd0e673c
Overlay media pipeline PHP/JS/SQL on compose, nginx HLS location, enable feature in lab config.php, and ensure media storage dirs on BE nodes. Co-authored-by: Cursor <cursoragent@cursor.com>
369 lines
13 KiB
Plaintext
369 lines
13 KiB
Plaintext
# Full androidcast vhost for Alpine BE — listen 80 only.
|
||
# FE (apps.f0xx.org / s.f0xx.org / notify.f0xx.org) proxies here: cast01–03 cluster :80
|
||
# Port 8089 is a different service (e.g. Janus) — not this vhost.
|
||
|
||
map $http_upgrade $connection_upgrade {
|
||
default upgrade;
|
||
'' close;
|
||
}
|
||
|
||
# FE terminates TLS; upstream to this vhost is plain HTTP. Prefer X-Forwarded-Proto,
|
||
# else force https for known public hostnames so redirects/cookies stay secure.
|
||
map $http_x_forwarded_proto $fe_scheme {
|
||
default $scheme;
|
||
https https;
|
||
http http;
|
||
}
|
||
map $http_host $public_scheme {
|
||
default $fe_scheme;
|
||
apps.f0xx.org https;
|
||
s.f0xx.org https;
|
||
notify.f0xx.org https;
|
||
acl0.f0xx.org https;
|
||
~^c[1-3]\.acl0\.f0xx\.org$ https;
|
||
}
|
||
|
||
server {
|
||
listen 80 default_server;
|
||
listen [::]:80 default_server;
|
||
|
||
# FE proxies https://apps.f0xx.org/ here as GET / — hub lives under /app/androidcast_project/
|
||
location = / {
|
||
return 301 $public_scheme://$http_host/app/androidcast_project/;
|
||
}
|
||
|
||
# OTA v0 static tree — devices fetch https://apps.f0xx.org/v0/ota/channel/stable.json
|
||
location ^~ /v0/ota/ {
|
||
alias /var/www/localhost/htdocs/apps/app/androidcast_project/ota-artifacts/v0/ota/;
|
||
add_header Cache-Control "public, max-age=60";
|
||
}
|
||
|
||
# Hub download artifacts (Session Studio jar, etc.) — populated by deploy-hub-downloads.sh
|
||
location ^~ /v0/downloads/ {
|
||
alias /var/www/localhost/htdocs/apps/app/androidcast_project/downloads/;
|
||
add_header Cache-Control "public, max-age=300";
|
||
default_type application/octet-stream;
|
||
}
|
||
|
||
# Favicon — served from hub root (shared by all sub-apps via explicit <link> tags)
|
||
location = /favicon.ico {
|
||
alias /var/www/localhost/htdocs/apps/app/androidcast_project/favicon.ico;
|
||
access_log off;
|
||
expires 7d;
|
||
}
|
||
location = /apple-touch-icon.ico {
|
||
alias /var/www/localhost/htdocs/apps/app/androidcast_project/apple-touch-icon.ico;
|
||
access_log off;
|
||
expires 7d;
|
||
}
|
||
|
||
location = /app/androidcast_project {
|
||
return 301 $public_scheme://$http_host/app/androidcast_project/;
|
||
}
|
||
|
||
location = /app/androidcast_project/index.php {
|
||
include fastcgi_params;
|
||
fastcgi_pass 127.0.0.1:9000;
|
||
fastcgi_param SCRIPT_FILENAME /var/www/localhost/htdocs/apps/app/androidcast_project/index.php;
|
||
fastcgi_param SCRIPT_NAME /app/androidcast_project/index.php;
|
||
}
|
||
|
||
location = /app/androidcast_project/ {
|
||
rewrite ^ /app/androidcast_project/index.php last;
|
||
}
|
||
|
||
# Shared session auth at project root — composed ac/* backend
|
||
# Includes 2FA cross-device and polling endpoints
|
||
location ~ ^/app/androidcast_project/(login|logout|register|two-factor(?:/approve)?|verify-email|api/two-factor(?:/poll)?)(/|$) {
|
||
include fastcgi_params;
|
||
fastcgi_pass 127.0.0.1:9000;
|
||
fastcgi_param SCRIPT_FILENAME /var/www/ac/composed/backend/public/index.php;
|
||
fastcgi_param SCRIPT_NAME /app/androidcast_project/issues/index.php;
|
||
fastcgi_param REQUEST_URI $request_uri;
|
||
client_max_body_size 4m;
|
||
}
|
||
|
||
location /app/androidcast_project/ {
|
||
alias /var/www/localhost/htdocs/apps/app/androidcast_project/;
|
||
index index.php index.html;
|
||
try_files $uri $uri/ =404;
|
||
}
|
||
|
||
location = /app/androidcast_project/graphs {
|
||
return 301 $public_scheme://$http_host/app/androidcast_project/graphs/;
|
||
}
|
||
|
||
# --- /issues/ served from composed ac/* backend ---
|
||
location = /app/androidcast_project/issues {
|
||
return 301 $public_scheme://$http_host/app/androidcast_project/issues/;
|
||
}
|
||
|
||
location ^~ /app/androidcast_project/issues/assets/ {
|
||
alias /var/www/ac/composed/backend/public/assets/;
|
||
}
|
||
|
||
location = /app/androidcast_project/issues/api/upload.php {
|
||
include fastcgi_params;
|
||
fastcgi_pass 127.0.0.1:9000;
|
||
fastcgi_param SCRIPT_FILENAME /var/www/ac/composed/backend/public/api/upload.php;
|
||
fastcgi_param SCRIPT_NAME /app/androidcast_project/issues/api/upload.php;
|
||
fastcgi_param REQUEST_URI $request_uri;
|
||
client_max_body_size 4m;
|
||
}
|
||
|
||
location ^~ /app/androidcast_project/issues/ {
|
||
include fastcgi_params;
|
||
fastcgi_pass 127.0.0.1:9000;
|
||
fastcgi_param SCRIPT_FILENAME /var/www/ac/composed/backend/public/index.php;
|
||
fastcgi_param SCRIPT_NAME /app/androidcast_project/issues/index.php;
|
||
fastcgi_param REQUEST_URI $request_uri;
|
||
client_max_body_size 4m;
|
||
}
|
||
|
||
# Legacy /crashes/ → 301 to /issues/ (SPEC §7)
|
||
location = /app/androidcast_project/crashes {
|
||
return 301 $public_scheme://$http_host/app/androidcast_project/issues/;
|
||
}
|
||
|
||
location ^~ /app/androidcast_project/crashes/ {
|
||
rewrite ^/app/androidcast_project/crashes/?(.*)$ $public_scheme://$http_host/app/androidcast_project/issues/$1 permanent;
|
||
}
|
||
|
||
location ^~ /app/androidcast_project/crashes/assets/ {
|
||
alias /var/www/ac/composed/backend/public/assets/;
|
||
}
|
||
|
||
location = /app/androidcast_project/crashes/api/upload.php {
|
||
return 301 $public_scheme://$http_host/app/androidcast_project/issues/api/upload.php;
|
||
}
|
||
|
||
location ^~ /app/androidcast_project/graphs/assets/ {
|
||
alias /var/www/ac/composed/backend/public/assets/;
|
||
}
|
||
|
||
location = /app/androidcast_project/graphs/api/graphs.php {
|
||
include fastcgi_params;
|
||
fastcgi_pass 127.0.0.1:9000;
|
||
fastcgi_param SCRIPT_FILENAME /var/www/ac/composed/backend/public/api/graphs.php;
|
||
fastcgi_param SCRIPT_NAME /app/androidcast_project/graphs/api/graphs.php;
|
||
fastcgi_param REQUEST_URI $request_uri;
|
||
}
|
||
|
||
location = /app/androidcast_project/graphs/api/graph_upload.php {
|
||
include fastcgi_params;
|
||
fastcgi_pass 127.0.0.1:9000;
|
||
fastcgi_param SCRIPT_FILENAME /var/www/ac/composed/backend/public/api/graph_upload.php;
|
||
fastcgi_param SCRIPT_NAME /app/androidcast_project/graphs/api/graph_upload.php;
|
||
fastcgi_param REQUEST_URI $request_uri;
|
||
client_max_body_size 4m;
|
||
}
|
||
|
||
location ^~ /app/androidcast_project/graphs/ {
|
||
include fastcgi_params;
|
||
fastcgi_pass 127.0.0.1:9000;
|
||
fastcgi_param SCRIPT_FILENAME /var/www/ac/composed/backend/public/index.php;
|
||
fastcgi_param SCRIPT_NAME /app/androidcast_project/graphs/index.php;
|
||
fastcgi_param REQUEST_URI $request_uri;
|
||
client_max_body_size 4m;
|
||
}
|
||
|
||
location = /app/androidcast_project/build {
|
||
return 301 $public_scheme://$http_host/app/androidcast_project/build/;
|
||
}
|
||
|
||
location ^~ /app/androidcast_project/build/assets/ {
|
||
alias /var/www/ac/workspace/ac-be-builder/public/assets/;
|
||
}
|
||
|
||
location ^~ /app/androidcast_project/build/ {
|
||
include fastcgi_params;
|
||
fastcgi_pass 127.0.0.1:9000;
|
||
fastcgi_param SCRIPT_FILENAME /var/www/ac/workspace/ac-be-builder/public/index.php;
|
||
fastcgi_param SCRIPT_NAME /app/androidcast_project/build/index.php;
|
||
fastcgi_param REQUEST_URI $request_uri;
|
||
client_max_body_size 512m;
|
||
fastcgi_read_timeout 1800s;
|
||
}
|
||
|
||
# ── grafana-auth-check: internal auth_request endpoint ───────────────────
|
||
location = /app/androidcast_project/api/grafana-auth-check.php {
|
||
internal;
|
||
include fastcgi_params;
|
||
fastcgi_pass 127.0.0.1:9000;
|
||
fastcgi_param SCRIPT_FILENAME /var/www/ac/composed/backend/public/api/grafana-auth-check.php;
|
||
fastcgi_param SCRIPT_NAME /app/androidcast_project/api/grafana-auth-check.php;
|
||
fastcgi_param REQUEST_URI $request_uri;
|
||
fastcgi_param HTTP_COOKIE $http_cookie;
|
||
}
|
||
|
||
location @monitor_login_redirect {
|
||
return 302 $public_scheme://$http_host/app/androidcast_project/login?redirect=$request_uri;
|
||
}
|
||
|
||
# ── Grafana at cast04:3000 ────────────────────────────────────────────────
|
||
location = /app/androidcast_project/monitor {
|
||
return 301 $public_scheme://$http_host/app/androidcast_project/monitor/;
|
||
}
|
||
location /app/androidcast_project/monitor/ {
|
||
auth_request /app/androidcast_project/api/grafana-auth-check.php;
|
||
auth_request_set $grafana_user $upstream_http_x_webauth_user;
|
||
error_page 401 = @monitor_login_redirect;
|
||
proxy_pass http://10.7.16.239:3000/;
|
||
proxy_set_header Host $http_host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_set_header X-WEBAUTH-USER $grafana_user;
|
||
proxy_http_version 1.1;
|
||
proxy_read_timeout 300;
|
||
proxy_send_timeout 300;
|
||
proxy_set_header Upgrade $http_upgrade;
|
||
proxy_set_header Connection $connection_upgrade;
|
||
}
|
||
|
||
# ── Alertmanager at cast04:9093 ───────────────────────────────────────────
|
||
location = /app/androidcast_project/alertmanager {
|
||
return 301 $public_scheme://$http_host/app/androidcast_project/alertmanager/;
|
||
}
|
||
location /app/androidcast_project/alertmanager/ {
|
||
auth_request /app/androidcast_project/api/grafana-auth-check.php;
|
||
auth_request_set $grafana_user $upstream_http_x_webauth_user;
|
||
error_page 401 = @monitor_login_redirect;
|
||
proxy_pass http://10.7.16.239:9093/;
|
||
proxy_set_header Host $http_host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_http_version 1.1;
|
||
proxy_read_timeout 120;
|
||
proxy_send_timeout 120;
|
||
}
|
||
|
||
# ── Broadcast admin dashboard (/app/androidcast_project/broadcast/) ───────
|
||
location = /app/androidcast_project/broadcast {
|
||
return 301 $public_scheme://$http_host/app/androidcast_project/broadcast/;
|
||
}
|
||
location /app/androidcast_project/broadcast/ {
|
||
auth_request /app/androidcast_project/api/grafana-auth-check.php;
|
||
auth_request_set $auth_user $upstream_http_x_webauth_user;
|
||
error_page 401 = @monitor_login_redirect;
|
||
include fastcgi_params;
|
||
fastcgi_pass 127.0.0.1:9000;
|
||
fastcgi_param SCRIPT_FILENAME /var/www/ac/broadcast/public/index.php;
|
||
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
|
||
fastcgi_param REQUEST_URI $request_uri;
|
||
fastcgi_param HTTP_COOKIE $http_cookie;
|
||
fastcgi_param HTTP_AUTHORIZATION $http_authorization;
|
||
}
|
||
|
||
# --- Gitea web UI (lab browse; mirrors configured separately) ---
|
||
location = /app/androidcast_project/git {
|
||
return 301 $public_scheme://$http_host/app/androidcast_project/git/;
|
||
}
|
||
location ^~ /app/androidcast_project/git/ {
|
||
# Gitea runs on cast01 only — do not proxy to 127.0.0.1 on cast02/cast03.
|
||
proxy_pass http://10.7.16.236:3000/;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_set_header X-Forwarded-Host $host;
|
||
proxy_set_header Upgrade $http_upgrade;
|
||
proxy_set_header Connection $connection_upgrade;
|
||
proxy_read_timeout 1800s;
|
||
proxy_send_timeout 1800s;
|
||
client_max_body_size 512m;
|
||
}
|
||
|
||
# ── Media pipelines HLS (streaming_v2 experimental) ─────────────────────
|
||
location ^~ /app/androidcast_project/media/hls/ {
|
||
alias /var/www/ac/media-pipelines/hls/;
|
||
add_header Cache-Control "no-cache";
|
||
add_header Access-Control-Allow-Origin "*";
|
||
types {
|
||
application/vnd.apple.mpegurl m3u8;
|
||
video/mp2t ts;
|
||
}
|
||
default_type application/vnd.apple.mpegurl;
|
||
}
|
||
|
||
# ── SFU signaling — Janus Gateway WebRTC backend ─────────────────────────
|
||
# REST API → PHP signaling service
|
||
location /app/androidcast_project/sfu/api/ {
|
||
include fastcgi_params;
|
||
fastcgi_pass 127.0.0.1:9000;
|
||
fastcgi_param SCRIPT_FILENAME /var/www/ac/workspace/ac-ms-sfu-signaling/public/index.php;
|
||
fastcgi_param SCRIPT_NAME /app/androidcast_project/sfu/index.php;
|
||
fastcgi_param REQUEST_URI $request_uri;
|
||
fastcgi_param HTTP_COOKIE $http_cookie;
|
||
fastcgi_param HTTP_AUTHORIZATION $http_authorization;
|
||
}
|
||
|
||
# WebSocket → Janus on cast02
|
||
location /app/androidcast_project/sfu/ws {
|
||
proxy_pass http://@CAST02_IP@:8188/;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Upgrade $http_upgrade;
|
||
proxy_set_header Connection $connection_upgrade;
|
||
proxy_set_header Host $host;
|
||
proxy_read_timeout 3600s;
|
||
}
|
||
|
||
# Catch-all SFU paths → PHP signaling front controller
|
||
location = /app/androidcast_project/sfu {
|
||
return 301 $public_scheme://$http_host/app/androidcast_project/sfu/;
|
||
}
|
||
|
||
location ^~ /app/androidcast_project/sfu/ {
|
||
include fastcgi_params;
|
||
fastcgi_pass 127.0.0.1:9000;
|
||
fastcgi_param SCRIPT_FILENAME /var/www/ac/workspace/ac-ms-sfu-signaling/public/index.php;
|
||
fastcgi_param SCRIPT_NAME /app/androidcast_project/sfu/index.php;
|
||
fastcgi_param REQUEST_URI $request_uri;
|
||
fastcgi_param HTTP_COOKIE $http_cookie;
|
||
fastcgi_param HTTP_AUTHORIZATION $http_authorization;
|
||
}
|
||
|
||
location ~ \.php$ {
|
||
include /etc/nginx/fastcgi.conf;
|
||
fastcgi_pass 127.0.0.1:9000;
|
||
}
|
||
}
|
||
|
||
# ── notify.f0xx.org — Broadcast public landing pages ─────────────────────────
|
||
# CNAME: notify.f0xx.org → apps.f0xx.org → cluster (cast01–03)
|
||
server {
|
||
listen 80;
|
||
listen [::]:80;
|
||
server_name notify.f0xx.org;
|
||
|
||
root /var/www/ac/broadcast/public;
|
||
index index.php;
|
||
|
||
location = /favicon.ico {
|
||
alias /var/www/localhost/htdocs/apps/app/androidcast_project/favicon.ico;
|
||
access_log off;
|
||
expires 7d;
|
||
}
|
||
|
||
location / {
|
||
try_files $uri /index.php?$query_string;
|
||
}
|
||
|
||
location ~ \.php$ {
|
||
include fastcgi_params;
|
||
fastcgi_pass 127.0.0.1:9000;
|
||
fastcgi_param SCRIPT_FILENAME /var/www/ac/broadcast/public/index.php;
|
||
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
|
||
fastcgi_param REQUEST_URI $request_uri;
|
||
fastcgi_param HTTP_COOKIE $http_cookie;
|
||
fastcgi_param HTTP_AUTHORIZATION $http_authorization;
|
||
}
|
||
|
||
location ~* \.(js|css|png|jpg|ico|woff2?)$ {
|
||
expires 7d;
|
||
add_header Cache-Control "public";
|
||
}
|
||
}
|