claudeandClaude Sonnet 4.6
eb74c4fced
Previously only output.* (output.html, output.pdf, etc.) bypassed the web server. Companion assets (CSS, JS, images, videos, fonts) from Quarto/RevealJS presentations went through the web server, hitting the miscOutputDownload rate limiter (1000 req/hour per project). A heavy presentation loads 50+ assets per page view and would exhaust the limit quickly, returning 429 for most assets and leaving the page unstyled. The build ID is an unguessable random token — the same security model already used for output.html being served without auth. Routing all output files through clsi-nginx is safe and also fixes Content-Type for media files (video/mp4 etc.) now that the mime type fix is in place. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
104 lines
3.1 KiB
Plaintext
104 lines
3.1 KiB
Plaintext
server {
|
|
listen 80;
|
|
server_name _; # Catch all, see http://nginx.org/en/docs/http/server_names.html
|
|
|
|
root /overleaf/services/web/public/;
|
|
|
|
# block external access to prometheus /metrics
|
|
location /metrics {
|
|
internal;
|
|
}
|
|
|
|
# File upload endpoints: extended timeouts for large files on slow connections.
|
|
# proxy_request_buffering off: forward the request body to Node.js immediately
|
|
# rather than buffering first, so Node.js can send a keepalive response byte
|
|
# before the full body arrives (preventing upstream proxy "first-byte" timeouts).
|
|
# proxy_buffering off: forward that keepalive byte to Traefik/LB without delay.
|
|
location ~ ^/project/[^/]+/upload$ {
|
|
proxy_pass http://127.0.0.1:4000;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_request_buffering off;
|
|
proxy_buffering off;
|
|
proxy_read_timeout 15m;
|
|
proxy_send_timeout 15m;
|
|
send_timeout 15m;
|
|
client_body_timeout 15m;
|
|
client_max_body_size 550m;
|
|
}
|
|
|
|
location / {
|
|
proxy_pass http://127.0.0.1:4000;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_read_timeout 10m;
|
|
proxy_send_timeout 10m;
|
|
}
|
|
|
|
location /socket.io {
|
|
proxy_pass http://127.0.0.1:3026;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_read_timeout 10m;
|
|
proxy_send_timeout 10m;
|
|
}
|
|
|
|
location /stylesheets {
|
|
expires 1y;
|
|
}
|
|
|
|
location /minjs {
|
|
expires 1y;
|
|
}
|
|
|
|
location /img {
|
|
expires 1y;
|
|
}
|
|
|
|
# handle output files for specific users (all files, not just output.*)
|
|
# Security: build ID is an unguessable random token, same model as output.html
|
|
location ~ ^/project/([0-9a-f]+)/user/([0-9a-f]+)/build/([0-9a-f-]+)/output/.+ {
|
|
proxy_pass http://127.0.0.1:8080; # clsi-nginx.conf
|
|
proxy_http_version 1.1;
|
|
}
|
|
# handle output files for anonymous users
|
|
location ~ ^/project/([0-9a-f]+)/build/([0-9a-f-]+)/output/.+ {
|
|
proxy_pass http://127.0.0.1:8080; # clsi-nginx.conf
|
|
proxy_http_version 1.1;
|
|
}
|
|
# PDF range for specific users
|
|
location ~ ^/project/([0-9a-f]+)/user/([0-9a-f]+)/content/([0-9a-f-]+/[0-9a-f]+)$ {
|
|
proxy_pass http://127.0.0.1:8080; # clsi-nginx.conf
|
|
proxy_http_version 1.1;
|
|
}
|
|
# PDF range for anonymous users
|
|
location ~ ^/project/([0-9a-f]+)/content/([0-9a-f-]+/[0-9a-f]+)$ {
|
|
proxy_pass http://127.0.0.1:8080; # clsi-nginx.conf
|
|
proxy_http_version 1.1;
|
|
}
|
|
|
|
# block external access to metrics
|
|
location ~* ^/metrics/?$ {
|
|
return 404 'Not found';
|
|
}
|
|
|
|
# block external access to all health checks /health_check, /health_check/full, etc
|
|
location ~* ^/health_check {
|
|
return 404 'Not found';
|
|
}
|
|
|
|
# Load any extra configuration for this vhost
|
|
include /etc/nginx/vhost-extras/overleaf/*.conf;
|
|
}
|