73 lines
3.4 KiB
Plaintext
73 lines
3.4 KiB
Plaintext
# /etc/nginx/sites-available/jqc_multi
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
# Tenant subdomains: *.jqc.app → 127.0.0.1:8000
|
|
#
|
|
# MT-24. The critical line in this file is:
|
|
#
|
|
# proxy_set_header X-Forwarded-Host $host;
|
|
#
|
|
# Nginx forwards unrecognised client request headers upstream. Without this
|
|
# line a client could send its own X-Forwarded-Host, and (when the app trusted
|
|
# it) choose which tenant database the request bound to — pre-authentication,
|
|
# from the open internet. Pinning it to $host makes the header say what nginx
|
|
# observed, never what the client claimed. The app no longer trusts the header
|
|
# at all (ProxyFix x_host=0), so this is the second of two independent layers.
|
|
#
|
|
# Keep both. Either alone closes the hole; both together mean a future change
|
|
# to one does not silently reopen it.
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
|
|
# ── Shared proxy header set ──────────────────────────────────────────────────
|
|
# Included by every location that proxies, so a new location cannot forget one.
|
|
# (Requires: include snippets in /etc/nginx/snippets/ or inline as below.)
|
|
|
|
server {
|
|
listen 443 ssl;
|
|
http2 on;
|
|
server_name *.jqc.app;
|
|
|
|
client_max_body_size 50M;
|
|
|
|
# Static assets. NOTE: this serves the app's static tree directly, which
|
|
# includes app/static/uploads on a local-storage deploy — every photo is
|
|
# then readable by anyone who knows or guesses its URL, with no session
|
|
# check. Filenames are random UUIDs so they are not enumerable, but they
|
|
# are also not access-controlled and never expire.
|
|
# This is retired per tenant at R2 cutover, when media moves to short-lived
|
|
# presigned URLs. Until then, treat it as a known exposure.
|
|
location /static/ {
|
|
alias /home/jqc/janitorial_qc/app/static/;
|
|
expires 30d;
|
|
}
|
|
|
|
location / {
|
|
proxy_pass http://127.0.0.1:8000;
|
|
|
|
proxy_set_header Host $host;
|
|
# MT-24 — pin, never inherit from the client. See header comment.
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
proxy_set_header X-Forwarded-Port $server_port;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
|
proxy_read_timeout 60s;
|
|
}
|
|
|
|
ssl_certificate /etc/letsencrypt/live/jqc.app-0001/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/jqc.app-0001/privkey.pem;
|
|
include /etc/letsencrypt/options-ssl-nginx.conf;
|
|
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
|
|
}
|
|
|
|
server {
|
|
listen 80;
|
|
server_name *.jqc.app;
|
|
|
|
# MT-24: the Certbot-generated `if ($host = *.jqc.app)` test is a literal
|
|
# string comparison — it never matches a wildcard server_name, so plain
|
|
# HTTP requests to tenant subdomains fell through with no redirect. This
|
|
# block matches only *.jqc.app already, so redirect unconditionally.
|
|
return 301 https://$host$request_uri;
|
|
}
|