Public Access
admin
7838c49721
- backend: settings SESSION_COOKIE_SECURE + TRUSTED_NETWORK_AUTO_AUTH, require_session uses secrets.compare_digest and respects trusted-network opt-in, main.py adds require_family_session middleware gating all /api/ routes except auth/admin/email-vote-token paths - docker-compose: pass SESSION_COOKIE_SECURE + TRUSTED_NETWORK_AUTO_AUTH through to backend + scheduler (fixes env-file changes not reaching runtime) - frontend: Ingress path-prefix support (APP_BASE_PATH, BrowserRouter basename, vite base './'), Login redirect honors APP_BASE_PATH - nginx: no-cache headers on root + /assets/ - docs: Home Assistant Ingress install/troubleshooting + plan file - tests: test_auth expects 401 on no-session GET Defaults: SESSION_COOKIE_SECURE=false, TRUSTED_NETWORK_AUTO_AUTH=true (HA is the auth boundary; MealPlanner must not be port-forwarded directly).
58 lines
1.8 KiB
Nginx Configuration File
58 lines
1.8 KiB
Nginx Configuration File
http {
|
|
include /etc/nginx/mime.types;
|
|
default_type application/octet-stream;
|
|
|
|
# Use Docker's internal DNS so upstream IPs are re-resolved after restarts
|
|
resolver 127.0.0.11 valid=10s;
|
|
resolver_timeout 5s;
|
|
|
|
server {
|
|
listen 80;
|
|
server_name _;
|
|
|
|
location /api/ {
|
|
set $backend_upstream http://backend:8000;
|
|
proxy_pass $backend_upstream;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection 'upgrade';
|
|
proxy_cache_bypass $http_upgrade;
|
|
}
|
|
|
|
location /static/ {
|
|
set $backend_upstream http://backend:8000;
|
|
proxy_pass $backend_upstream;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
}
|
|
|
|
location / {
|
|
set $frontend_upstream http://frontend:80;
|
|
proxy_pass $frontend_upstream;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate" always;
|
|
add_header Pragma "no-cache" always;
|
|
add_header Expires "0" always;
|
|
}
|
|
|
|
location /assets/ {
|
|
set $frontend_upstream http://frontend:80;
|
|
proxy_pass $frontend_upstream;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate" always;
|
|
add_header Pragma "no-cache" always;
|
|
add_header Expires "0" always;
|
|
}
|
|
}
|
|
}
|
|
|
|
events {
|
|
worker_connections 1024;
|
|
}
|