Finished BUD 1

config/nginx/ginxsom.conf

@@ -0,0 +1,131 @@
+# Ginxsom Blossom Server Configuration
+# This configuration serves files directly via nginx for maximum performance
+# while handling authenticated operations through FastCGI
+
+server {
+    listen 80;
+    server_name localhost;  # Change this to your domain
+    
+    # Root directory for blossom files (organized by SHA-256 hash)
+    root /var/lib/ginxsom/files;
+    
+    # Maximum upload size (adjust as needed)
+    client_max_body_size 100M;
+    
+    # Security headers
+    add_header X-Content-Type-Options nosniff;
+    add_header X-Frame-Options DENY;
+    add_header X-XSS-Protection "1; mode=block";
+    
+    # Logging
+    access_log /var/log/nginx/ginxsom_access.log;
+    error_log /var/log/nginx/ginxsom_error.log;
+    
+    # Static file serving - nginx handles this directly for maximum performance
+    # Files are stored as: /var/lib/ginxsom/files/{first2chars}/{remaining_hash}
+    location ~ ^/([a-f0-9]{64})$ {
+        set $hash $1;
+        set $prefix $1;  # First 2 characters
+        set $suffix $1;  # Remaining characters
+        
+        # Extract first 2 chars and remaining
+        if ($hash ~ ^([a-f0-9]{2})([a-f0-9]{62})$) {
+            set $prefix $1;
+            set $suffix $2;
+        }
+        
+        try_files /$prefix/$suffix =404;
+        
+        # Set proper content type based on file extension in metadata
+        # This will be enhanced when we add metadata lookup
+        add_header Content-Type application/octet-stream;
+        add_header Cache-Control "public, max-age=31536000, immutable";
+    }
+    
+    # HEAD requests for file existence checking
+    # This endpoint checks if a file exists and returns metadata
+    location ~ ^/head/([a-f0-9]{64})$ {
+        # Pass to FastCGI application for metadata lookup
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME $document_root/ginxsom.fcgi;
+        fastcgi_param REQUEST_METHOD HEAD;
+        fastcgi_param BLOSSOM_HASH $1;
+        fastcgi_pass unix:/run/ginxsom/ginxsom.sock;
+    }
+    
+    # Upload endpoint - requires authentication
+    location /upload {
+        # Pass to FastCGI application for processing
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME $document_root/ginxsom.fcgi;
+        fastcgi_pass unix:/run/ginxsom/ginxsom.sock;
+        
+        # Only allow PUT method for uploads
+        if ($request_method !~ ^(PUT)$ ) {
+            return 405;
+        }
+    }
+    
+    # List endpoint - returns list of files (if enabled)
+    location /list {
+        # Pass to FastCGI application
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME $document_root/ginxsom.fcgi;
+        fastcgi_pass unix:/run/ginxsom/ginxsom.sock;
+        
+        # Only allow GET method
+        if ($request_method !~ ^(GET)$ ) {
+            return 405;
+        }
+    }
+    
+    # Mirror endpoint - for mirroring files from other servers
+    location /mirror {
+        # Pass to FastCGI application
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME $document_root/ginxsom.fcgi;
+        fastcgi_pass unix:/run/ginxsom/ginxsom.sock;
+        
+        # Only allow PUT method
+        if ($request_method !~ ^(PUT)$ ) {
+            return 405;
+        }
+    }
+    
+    # Delete endpoint - requires authentication
+    location ~ ^/([a-f0-9]{64})$ {
+        # Handle DELETE requests through FastCGI
+        if ($request_method = DELETE) {
+            include fastcgi_params;
+            fastcgi_param SCRIPT_FILENAME $document_root/ginxsom.fcgi;
+            fastcgi_param BLOSSOM_HASH $1;
+            fastcgi_pass unix:/run/ginxsom/ginxsom.sock;
+        }
+        
+        # For GET/HEAD, fall through to static file serving above
+    }
+    
+    # Health check endpoint
+    location /health {
+        # Pass to FastCGI application
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME $document_root/ginxsom.fcgi;
+        fastcgi_pass unix:/run/ginxsom/ginxsom.sock;
+        
+        access_log off;
+    }
+    
+    # Deny access to hidden files and directories
+    location ~ /\. {
+        deny all;
+        access_log off;
+        log_not_found off;
+    }
+    
+    # Deny access to backup and temporary files
+    location ~ ~$ {
+        deny all;
+        access_log off;
+        log_not_found off;
+    }
+}