gajae-code-app/docs/nginx-subpath-template.conf at main · devswha/gajae-code-app · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
# Publish Gajae Code App from a path below an otherwise independent Nginx site.
#
# This example exposes /ai/ and forwards the application server at
# http://127.0.0.1:3001/. The /ai prefix is removed before an application request
# is sent upstream: /ai/session/example becomes /session/example.
#
# Nginx does not expand variables in location patterns or rewrite expressions.
# If the public path changes, update $gajae_app_subpath plus each literal /ai
# location and rewrite together. The client currently keeps /api/, /ws, /shell
# and /health at the site root, so they remain separately proxied.
#
# When publishing a DNS hostname, set ALLOWED_HOSTS to that hostname in the
# app server's environment. HTTPS and server_name alone do not admit it;
# see SELF-HOST.md for the migration from implicit same-host admission.
#
# Directives are scoped to the routes that need them: Accept-Encoding is
# stripped only where sub_filter must read plaintext, upgrade headers travel
# only on WebSocket-capable routes, and /health keeps the default timeouts.

worker_processes 1; # a subpath proxy adds no CPU work of its own

events { worker_connections 1024; } # ample for a single-user deployment

http { # everything below serves the one mounted application
    # WebSocket upgrades need Connection: upgrade echoed; plain requests close.
    map $http_upgrade $connection_upgrade { default upgrade; '' close; }

    server { # the site that carries the /ai mount
        listen 80 default_server; # replace with TLS settings in a public deployment
        server_name localhost 127.0.0.1; # adjust to the published hostname

        # The literal locations below represent this public mount point.
        set $gajae_app_subpath /ai;
        # Only Nginx should need to reach this private application address.
        set $gajae_app_upstream http://127.0.0.1:3001;

        client_max_body_size 200M; # matches the application's upload ceiling

        proxy_http_version 1.1; # required for upgrades and chunked responses

        # Headers every proxied route forwards. Beware an Nginx inheritance
        # rule: a location that declares any proxy_set_header of its own
        # replaces this whole set, so such locations restate these four.
        proxy_set_header Host $host; # the app compares Origin against this
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; # keep the client chain
        proxy_set_header X-Forwarded-Proto $scheme; # tells the app how it was reached
        proxy_set_header X-Forwarded-Prefix $gajae_app_subpath; # the mount the app lives under

        # Preserve a trailing slash so browser-relative assets resolve under the mount.
        location = /ai { return 301 $gajae_app_subpath/; }

        # Main application surface: remove the public prefix before proxying.
        # [PATH] Change /ai in this location and rewrite with the configured subpath.
        location ^~ /ai/ { # longest-prefix match; wins over /api/ etc. below
            rewrite ^/ai(?<gajae_app_path>/.*)$ $gajae_app_path break;
            proxy_pass $gajae_app_upstream;

            proxy_set_header Host $host; # restated: see the inheritance note above
            proxy_set_header X-Real-IP $remote_addr; # nearest client hop
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; # restated
            proxy_set_header X-Forwarded-Proto $scheme; # restated
            proxy_set_header X-Forwarded-Prefix $gajae_app_subpath; # restated
            proxy_set_header Upgrade $http_upgrade; # pass WebSocket upgrades through
            proxy_set_header Connection $connection_upgrade; # via the map above
            proxy_read_timeout 1h; # agent runs stream for a long time
            proxy_send_timeout 1h; # keep slow uploads alive as long

            # Rewrite browser-rooted assets and PWA metadata for the mounted URL.
            proxy_set_header Accept-Encoding ""; # plaintext upstream so sub_filter can rewrite
            sub_filter_once off; # every occurrence, not just the first
            sub_filter_types application/json application/manifest+json application/javascript text/javascript;

            sub_filter 'href="/' 'href="$gajae_app_subpath/';
            sub_filter 'src="/' 'src="$gajae_app_subpath/';
            sub_filter "register('/sw.js')" "register('$gajae_app_subpath/sw.js')";
            sub_filter 'register("/sw.js")' 'register("$gajae_app_subpath/sw.js")';
            sub_filter '"start_url": "/"' '"start_url": "$gajae_app_subpath/"';
            sub_filter '"scope": "/"' '"scope": "$gajae_app_subpath/"';
            sub_filter '"src": "/' '"src": "$gajae_app_subpath/';
            sub_filter "'/manifest.json'" "'$gajae_app_subpath/manifest.json'";
            sub_filter '"/manifest.json"' '"$gajae_app_subpath/manifest.json"';
        }

        # Root-relative HTTP calls remain reachable while the browser is mounted at /ai/.
        location ^~ /api/ { # REST surface; forwarded headers inherited from above
            proxy_pass $gajae_app_upstream;
            proxy_read_timeout 1h; # some API calls follow long agent runs
            proxy_send_timeout 1h; # and large uploads take their time
        }

        # The chat WebSocket channel (plus /ws/browser) lives at the site root.
        location /ws { # prefix match, intentionally broad like the app's own router
            proxy_pass $gajae_app_upstream;
            proxy_set_header Host $host; # restated: see the inheritance note above
            proxy_set_header Upgrade $http_upgrade; # WebSocket handshake
            proxy_set_header Connection $connection_upgrade; # via the map above
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; # restated
            proxy_set_header X-Forwarded-Proto $scheme; # restated
            proxy_set_header X-Forwarded-Prefix $gajae_app_subpath; # restated
            proxy_read_timeout 1h; # sockets stay open across long agent runs
            proxy_send_timeout 1h; # in both directions
        }

        # The terminal WebSocket channel, same treatment as /ws.
        location /shell { # prefix match, intentionally broad like the app's own router
            proxy_pass $gajae_app_upstream;
            proxy_set_header Host $host; # restated: see the inheritance note above
            proxy_set_header Upgrade $http_upgrade; # WebSocket handshake
            proxy_set_header Connection $connection_upgrade; # via the map above
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; # restated
            proxy_set_header X-Forwarded-Proto $scheme; # restated
            proxy_set_header X-Forwarded-Prefix $gajae_app_subpath; # restated
            proxy_read_timeout 1h; # terminals idle for long stretches
            proxy_send_timeout 1h; # in both directions
        }

        # The version-check endpoint answers instantly; default timeouts suffice.
        location = /health { proxy_pass $gajae_app_upstream; } # headers inherited
    }
}