794 lines
36 KiB
Plaintext
794 lines
36 KiB
Plaintext
# Local Ginxsom Development Server Configuration
|
|
# Comprehensive Blossom Protocol Implementation
|
|
|
|
# Main context - specify error log here to override system default
|
|
# Set to warn level to capture FastCGI stderr messages
|
|
error_log logs/nginx/error.log warn;
|
|
pid logs/nginx/nginx.pid;
|
|
|
|
events {
|
|
worker_connections 1024;
|
|
}
|
|
|
|
# HTTP context
|
|
http {
|
|
# Basic settings
|
|
sendfile on;
|
|
tcp_nopush on;
|
|
tcp_nodelay on;
|
|
keepalive_timeout 65;
|
|
types_hash_max_size 2048;
|
|
|
|
# Temporary file paths (relative to nginx prefix)
|
|
client_body_temp_path tmp/nginx_temp;
|
|
|
|
# MIME types (local)
|
|
include mime.types;
|
|
default_type application/octet-stream;
|
|
|
|
# Logging (relative to prefix directory)
|
|
access_log logs/nginx/access.log;
|
|
|
|
# FastCGI upstream configuration
|
|
upstream fastcgi_backend {
|
|
server unix:/tmp/ginxsom-fcgi.sock;
|
|
}
|
|
|
|
# Map endpoints to their allowed methods for CORS
|
|
map $uri $cors_methods {
|
|
default "GET, HEAD, OPTIONS";
|
|
/upload "PUT, HEAD, OPTIONS";
|
|
/mirror "PUT, OPTIONS";
|
|
/report "PUT, OPTIONS";
|
|
/auth "GET, OPTIONS";
|
|
~^/list/ "GET, OPTIONS";
|
|
~^/api/ "GET, PUT, OPTIONS";
|
|
~^/[a-f0-9]\{64\} "GET, HEAD, DELETE, OPTIONS";
|
|
}
|
|
|
|
# Local development server - HTTP
|
|
server {
|
|
listen 9001;
|
|
server_name localhost;
|
|
|
|
# Root directory for blossom files (local blobs directory)
|
|
root blobs;
|
|
|
|
# Maximum upload size (adjust as needed)
|
|
client_max_body_size 100M;
|
|
|
|
# Security headers
|
|
add_header X-Content-Type-Options nosniff always;
|
|
add_header X-Frame-Options DENY always;
|
|
add_header X-XSS-Protection "1; mode=block" always;
|
|
|
|
# Universal CORS headers for all responses
|
|
add_header Access-Control-Allow-Origin * always;
|
|
add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, HEAD, OPTIONS, PATCH" always;
|
|
add_header Access-Control-Allow-Headers "Authorization, Content-Type, Content-Length, Accept, Origin, User-Agent, DNT, Cache-Control, X-Mx-ReqToken, Keep-Alive, X-Requested-With, If-Modified-Since, *" always;
|
|
add_header Access-Control-Max-Age 86400 always;
|
|
|
|
# Universal OPTIONS preflight handler
|
|
if ($request_method = OPTIONS) {
|
|
return 204;
|
|
}
|
|
|
|
# 1. SPECIFIC ENDPOINTS (most specific first)
|
|
|
|
# PUT /upload (BUD-02) - File uploads
|
|
location = /upload {
|
|
if ($request_method !~ ^(PUT|HEAD)$) {
|
|
return 405;
|
|
}
|
|
fastcgi_pass fastcgi_backend;
|
|
fastcgi_param QUERY_STRING $query_string;
|
|
fastcgi_param REQUEST_METHOD $request_method;
|
|
fastcgi_param CONTENT_TYPE $content_type;
|
|
fastcgi_param CONTENT_LENGTH $content_length;
|
|
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
|
|
fastcgi_param REQUEST_URI $request_uri;
|
|
fastcgi_param DOCUMENT_URI $document_uri;
|
|
fastcgi_param DOCUMENT_ROOT $document_root;
|
|
fastcgi_param SERVER_PROTOCOL $server_protocol;
|
|
fastcgi_param REQUEST_SCHEME $scheme;
|
|
fastcgi_param HTTPS $https if_not_empty;
|
|
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
|
|
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
|
|
fastcgi_param REMOTE_ADDR $remote_addr;
|
|
fastcgi_param REMOTE_PORT $remote_port;
|
|
fastcgi_param SERVER_ADDR $server_addr;
|
|
fastcgi_param SERVER_PORT $server_port;
|
|
fastcgi_param SERVER_NAME $server_name;
|
|
fastcgi_param REDIRECT_STATUS 200;
|
|
fastcgi_param SCRIPT_FILENAME $document_root/ginxsom.fcgi;
|
|
fastcgi_param HTTP_AUTHORIZATION $http_authorization;
|
|
}
|
|
|
|
# GET /list/<pubkey> (BUD-02) - List user's blobs
|
|
location ~ "^/list/([a-f0-9]{64})$" {
|
|
if ($request_method !~ ^(GET)$) {
|
|
return 405;
|
|
}
|
|
fastcgi_pass fastcgi_backend;
|
|
fastcgi_param QUERY_STRING $query_string;
|
|
fastcgi_param REQUEST_METHOD $request_method;
|
|
fastcgi_param CONTENT_TYPE $content_type;
|
|
fastcgi_param CONTENT_LENGTH $content_length;
|
|
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
|
|
fastcgi_param REQUEST_URI $request_uri;
|
|
fastcgi_param DOCUMENT_URI $document_uri;
|
|
fastcgi_param DOCUMENT_ROOT $document_root;
|
|
fastcgi_param SERVER_PROTOCOL $server_protocol;
|
|
fastcgi_param REQUEST_SCHEME $scheme;
|
|
fastcgi_param HTTPS $https if_not_empty;
|
|
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
|
|
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
|
|
fastcgi_param REMOTE_ADDR $remote_addr;
|
|
fastcgi_param REMOTE_PORT $remote_port;
|
|
fastcgi_param SERVER_ADDR $server_addr;
|
|
fastcgi_param SERVER_PORT $server_port;
|
|
fastcgi_param SERVER_NAME $server_name;
|
|
fastcgi_param REDIRECT_STATUS 200;
|
|
fastcgi_param SCRIPT_FILENAME $document_root/ginxsom.fcgi;
|
|
fastcgi_param HTTP_AUTHORIZATION $http_authorization;
|
|
}
|
|
|
|
# PUT /mirror (BUD-04) - Mirror content
|
|
location = /mirror {
|
|
if ($request_method !~ ^(PUT)$) {
|
|
return 405;
|
|
}
|
|
fastcgi_pass fastcgi_backend;
|
|
fastcgi_param QUERY_STRING $query_string;
|
|
fastcgi_param REQUEST_METHOD $request_method;
|
|
fastcgi_param CONTENT_TYPE $content_type;
|
|
fastcgi_param CONTENT_LENGTH $content_length;
|
|
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
|
|
fastcgi_param REQUEST_URI $request_uri;
|
|
fastcgi_param DOCUMENT_URI $document_uri;
|
|
fastcgi_param DOCUMENT_ROOT $document_root;
|
|
fastcgi_param SERVER_PROTOCOL $server_protocol;
|
|
fastcgi_param REQUEST_SCHEME $scheme;
|
|
fastcgi_param HTTPS $https if_not_empty;
|
|
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
|
|
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
|
|
fastcgi_param REMOTE_ADDR $remote_addr;
|
|
fastcgi_param REMOTE_PORT $remote_port;
|
|
fastcgi_param SERVER_ADDR $server_addr;
|
|
fastcgi_param SERVER_PORT $server_port;
|
|
fastcgi_param SERVER_NAME $server_name;
|
|
fastcgi_param REDIRECT_STATUS 200;
|
|
fastcgi_param SCRIPT_FILENAME $document_root/ginxsom.fcgi;
|
|
fastcgi_param HTTP_AUTHORIZATION $http_authorization;
|
|
}
|
|
|
|
# PUT /report (BUD-09) - Report content
|
|
location = /report {
|
|
if ($request_method !~ ^(PUT)$) {
|
|
return 405;
|
|
}
|
|
fastcgi_pass fastcgi_backend;
|
|
fastcgi_param QUERY_STRING $query_string;
|
|
fastcgi_param REQUEST_METHOD $request_method;
|
|
fastcgi_param CONTENT_TYPE $content_type;
|
|
fastcgi_param CONTENT_LENGTH $content_length;
|
|
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
|
|
fastcgi_param REQUEST_URI $request_uri;
|
|
fastcgi_param DOCUMENT_URI $document_uri;
|
|
fastcgi_param DOCUMENT_ROOT $document_root;
|
|
fastcgi_param SERVER_PROTOCOL $server_protocol;
|
|
fastcgi_param REQUEST_SCHEME $scheme;
|
|
fastcgi_param HTTPS $https if_not_empty;
|
|
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
|
|
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
|
|
fastcgi_param REMOTE_ADDR $remote_addr;
|
|
fastcgi_param REMOTE_PORT $remote_port;
|
|
fastcgi_param SERVER_ADDR $server_addr;
|
|
fastcgi_param SERVER_PORT $server_port;
|
|
fastcgi_param SERVER_NAME $server_name;
|
|
fastcgi_param REDIRECT_STATUS 200;
|
|
fastcgi_param SCRIPT_FILENAME $document_root/ginxsom.fcgi;
|
|
fastcgi_param HTTP_AUTHORIZATION $http_authorization;
|
|
}
|
|
|
|
# GET /auth (NIP-42) - Challenge generation
|
|
location = /auth {
|
|
if ($request_method !~ ^(GET)$) {
|
|
return 405;
|
|
}
|
|
fastcgi_pass fastcgi_backend;
|
|
fastcgi_param QUERY_STRING $query_string;
|
|
fastcgi_param REQUEST_METHOD $request_method;
|
|
fastcgi_param CONTENT_TYPE $content_type;
|
|
fastcgi_param CONTENT_LENGTH $content_length;
|
|
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
|
|
fastcgi_param REQUEST_URI $request_uri;
|
|
fastcgi_param DOCUMENT_URI $document_uri;
|
|
fastcgi_param DOCUMENT_ROOT $document_root;
|
|
fastcgi_param SERVER_PROTOCOL $server_protocol;
|
|
fastcgi_param REQUEST_SCHEME $scheme;
|
|
fastcgi_param HTTPS $https if_not_empty;
|
|
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
|
|
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
|
|
fastcgi_param REMOTE_ADDR $remote_addr;
|
|
fastcgi_param REMOTE_PORT $remote_port;
|
|
fastcgi_param SERVER_ADDR $server_addr;
|
|
fastcgi_param SERVER_PORT $server_port;
|
|
fastcgi_param SERVER_NAME $server_name;
|
|
fastcgi_param REDIRECT_STATUS 200;
|
|
fastcgi_param SCRIPT_FILENAME $document_root/ginxsom.fcgi;
|
|
fastcgi_param HTTP_AUTHORIZATION $http_authorization;
|
|
}
|
|
|
|
# Admin web interface (/admin)
|
|
location /admin {
|
|
if ($request_method !~ ^(GET)$) {
|
|
return 405;
|
|
}
|
|
fastcgi_pass fastcgi_backend;
|
|
fastcgi_param QUERY_STRING $query_string;
|
|
fastcgi_param REQUEST_METHOD $request_method;
|
|
fastcgi_param CONTENT_TYPE $content_type;
|
|
fastcgi_param CONTENT_LENGTH $content_length;
|
|
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
|
|
fastcgi_param REQUEST_URI $request_uri;
|
|
fastcgi_param DOCUMENT_URI $document_uri;
|
|
fastcgi_param DOCUMENT_ROOT $document_root;
|
|
fastcgi_param SERVER_PROTOCOL $server_protocol;
|
|
fastcgi_param REQUEST_SCHEME $scheme;
|
|
fastcgi_param HTTPS $https if_not_empty;
|
|
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
|
|
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
|
|
fastcgi_param REMOTE_ADDR $remote_addr;
|
|
fastcgi_param REMOTE_PORT $remote_port;
|
|
fastcgi_param SERVER_ADDR $server_addr;
|
|
fastcgi_param SERVER_PORT $server_port;
|
|
fastcgi_param SERVER_NAME $server_name;
|
|
fastcgi_param REDIRECT_STATUS 200;
|
|
fastcgi_param SCRIPT_FILENAME $document_root/ginxsom.fcgi;
|
|
fastcgi_param HTTP_AUTHORIZATION $http_authorization;
|
|
}
|
|
|
|
# Admin API endpoints (/api/*)
|
|
location /api/ {
|
|
if ($request_method !~ ^(GET|PUT|POST)$) {
|
|
return 405;
|
|
}
|
|
fastcgi_pass fastcgi_backend;
|
|
fastcgi_param QUERY_STRING $query_string;
|
|
fastcgi_param REQUEST_METHOD $request_method;
|
|
fastcgi_param CONTENT_TYPE $content_type;
|
|
fastcgi_param CONTENT_LENGTH $content_length;
|
|
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
|
|
fastcgi_param REQUEST_URI $request_uri;
|
|
fastcgi_param DOCUMENT_URI $document_uri;
|
|
fastcgi_param DOCUMENT_ROOT $document_root;
|
|
fastcgi_param SERVER_PROTOCOL $server_protocol;
|
|
fastcgi_param REQUEST_SCHEME $scheme;
|
|
fastcgi_param HTTPS $https if_not_empty;
|
|
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
|
|
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
|
|
fastcgi_param REMOTE_ADDR $remote_addr;
|
|
fastcgi_param REMOTE_PORT $remote_port;
|
|
fastcgi_param SERVER_ADDR $server_addr;
|
|
fastcgi_param SERVER_PORT $server_port;
|
|
fastcgi_param SERVER_NAME $server_name;
|
|
fastcgi_param REDIRECT_STATUS 200;
|
|
fastcgi_param SCRIPT_FILENAME $document_root/ginxsom.fcgi;
|
|
fastcgi_param HTTP_AUTHORIZATION $http_authorization;
|
|
}
|
|
|
|
# 2. BLOB OPERATIONS (SHA256 patterns)
|
|
|
|
# GET/HEAD/DELETE /<sha256> (BUD-01) - Blob operations with optional file extensions
|
|
location ~ "^/([a-f0-9]{64})(\.[a-zA-Z0-9]+)?$" {
|
|
# Handle DELETE method via rewrite to avoid fastcgi_param in if block
|
|
if ($request_method = DELETE) {
|
|
rewrite ^/(.*)$ /fcgi-delete/$1 last;
|
|
}
|
|
|
|
# Route HEAD requests to FastCGI for metadata
|
|
if ($request_method = HEAD) {
|
|
rewrite ^/(.*)$ /fcgi-head/$1 last;
|
|
}
|
|
|
|
# Only allow GET for file serving at this point
|
|
if ($request_method != GET) {
|
|
return 405;
|
|
}
|
|
|
|
# GET requests - serve files directly with extension fallback
|
|
try_files /$1.txt /$1.jpg /$1.jpeg /$1.png /$1.webp /$1.gif /$1.pdf /$1.mp4 /$1.mp3 /$1.md =404;
|
|
|
|
# Cache headers for blob content
|
|
add_header Cache-Control "public, max-age=31536000, immutable";
|
|
add_header Access-Control-Allow-Origin * always;
|
|
add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, HEAD, OPTIONS, PATCH" always;
|
|
add_header Access-Control-Allow-Headers "Authorization, Content-Type, Content-Length, Accept, Origin, User-Agent, DNT, Cache-Control, X-Mx-ReqToken, Keep-Alive, X-Requested-With, If-Modified-Since, *" always;
|
|
add_header Access-Control-Max-Age 86400 always;
|
|
}
|
|
|
|
# Internal handler for DELETE operations
|
|
location ~ "^/fcgi-delete/([a-f0-9]{64}).*$" {
|
|
internal;
|
|
fastcgi_pass fastcgi_backend;
|
|
fastcgi_param QUERY_STRING $query_string;
|
|
fastcgi_param REQUEST_METHOD DELETE;
|
|
fastcgi_param CONTENT_TYPE $content_type;
|
|
fastcgi_param CONTENT_LENGTH $content_length;
|
|
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
|
|
fastcgi_param REQUEST_URI /$1;
|
|
fastcgi_param DOCUMENT_URI /$1;
|
|
fastcgi_param DOCUMENT_ROOT $document_root;
|
|
fastcgi_param SERVER_PROTOCOL $server_protocol;
|
|
fastcgi_param REQUEST_SCHEME $scheme;
|
|
fastcgi_param HTTPS $https if_not_empty;
|
|
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
|
|
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
|
|
fastcgi_param REMOTE_ADDR $remote_addr;
|
|
fastcgi_param REMOTE_PORT $remote_port;
|
|
fastcgi_param SERVER_ADDR $server_addr;
|
|
fastcgi_param SERVER_PORT $server_port;
|
|
fastcgi_param SERVER_NAME $server_name;
|
|
fastcgi_param REDIRECT_STATUS 200;
|
|
fastcgi_param SCRIPT_FILENAME $document_root/ginxsom.fcgi;
|
|
fastcgi_param HTTP_AUTHORIZATION $http_authorization;
|
|
}
|
|
|
|
# FastCGI handler for HEAD requests
|
|
location ~ "^/fcgi-head/([a-f0-9]{64}).*$" {
|
|
internal;
|
|
fastcgi_pass fastcgi_backend;
|
|
fastcgi_param QUERY_STRING $query_string;
|
|
fastcgi_param REQUEST_METHOD HEAD;
|
|
fastcgi_param CONTENT_TYPE $content_type;
|
|
fastcgi_param CONTENT_LENGTH $content_length;
|
|
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
|
|
fastcgi_param REQUEST_URI /$1;
|
|
fastcgi_param DOCUMENT_URI /$1;
|
|
fastcgi_param DOCUMENT_ROOT $document_root;
|
|
fastcgi_param SERVER_PROTOCOL $server_protocol;
|
|
fastcgi_param REQUEST_SCHEME $scheme;
|
|
fastcgi_param HTTPS $https if_not_empty;
|
|
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
|
|
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
|
|
fastcgi_param REMOTE_ADDR $remote_addr;
|
|
fastcgi_param REMOTE_PORT $remote_port;
|
|
fastcgi_param SERVER_ADDR $server_addr;
|
|
fastcgi_param SERVER_PORT $server_port;
|
|
fastcgi_param SERVER_NAME $server_name;
|
|
fastcgi_param REDIRECT_STATUS 200;
|
|
fastcgi_param SCRIPT_FILENAME $document_root/ginxsom.fcgi;
|
|
fastcgi_param HTTP_AUTHORIZATION $http_authorization;
|
|
}
|
|
|
|
# 3. UTILITY ENDPOINTS
|
|
|
|
# Health check endpoint
|
|
location /health {
|
|
access_log off;
|
|
return 200 "OK\n";
|
|
add_header Content-Type text/plain;
|
|
add_header Access-Control-Allow-Origin * always;
|
|
add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, HEAD, OPTIONS, PATCH" always;
|
|
add_header Access-Control-Allow-Headers "Authorization, Content-Type, Content-Length, Accept, Origin, User-Agent, DNT, Cache-Control, X-Mx-ReqToken, Keep-Alive, X-Requested-With, If-Modified-Since, *" always;
|
|
add_header Access-Control-Max-Age 86400 always;
|
|
}
|
|
|
|
# List files endpoint for debugging
|
|
location /debug/list {
|
|
autoindex on;
|
|
autoindex_format json;
|
|
}
|
|
|
|
# Root endpoint - Server info from FastCGI
|
|
location = / {
|
|
if ($request_method !~ ^(GET)$) {
|
|
return 405;
|
|
}
|
|
fastcgi_pass fastcgi_backend;
|
|
fastcgi_param QUERY_STRING $query_string;
|
|
fastcgi_param REQUEST_METHOD $request_method;
|
|
fastcgi_param CONTENT_TYPE $content_type;
|
|
fastcgi_param CONTENT_LENGTH $content_length;
|
|
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
|
|
fastcgi_param REQUEST_URI $request_uri;
|
|
fastcgi_param DOCUMENT_URI $document_uri;
|
|
fastcgi_param DOCUMENT_ROOT $document_root;
|
|
fastcgi_param SERVER_PROTOCOL $server_protocol;
|
|
fastcgi_param REQUEST_SCHEME $scheme;
|
|
fastcgi_param HTTPS $https if_not_empty;
|
|
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
|
|
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
|
|
fastcgi_param REMOTE_ADDR $remote_addr;
|
|
fastcgi_param REMOTE_PORT $remote_port;
|
|
fastcgi_param SERVER_ADDR $server_addr;
|
|
fastcgi_param SERVER_PORT $server_port;
|
|
fastcgi_param SERVER_NAME $server_name;
|
|
fastcgi_param REDIRECT_STATUS 200;
|
|
fastcgi_param SCRIPT_FILENAME $document_root/ginxsom.fcgi;
|
|
fastcgi_param HTTP_AUTHORIZATION $http_authorization;
|
|
}
|
|
}
|
|
|
|
# Local development server - HTTPS
|
|
server {
|
|
listen 9443 ssl;
|
|
server_name localhost;
|
|
|
|
# SSL Configuration using existing certificates
|
|
ssl_certificate /home/teknari/.ssl_for_local_servers/cert.pem;
|
|
ssl_certificate_key /home/teknari/.ssl_for_local_servers/key.pem;
|
|
|
|
# SSL Security settings
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_prefer_server_ciphers on;
|
|
ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
|
|
|
|
# Root directory for blossom files (local blobs directory)
|
|
root blobs;
|
|
|
|
# Maximum upload size (adjust as needed)
|
|
client_max_body_size 100M;
|
|
|
|
# Security headers
|
|
add_header X-Content-Type-Options nosniff always;
|
|
add_header X-Frame-Options DENY always;
|
|
add_header X-XSS-Protection "1; mode=block" always;
|
|
|
|
# Universal CORS headers for all responses
|
|
add_header Access-Control-Allow-Origin * always;
|
|
add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, HEAD, OPTIONS, PATCH" always;
|
|
add_header Access-Control-Allow-Headers "Authorization, Content-Type, Content-Length, Accept, Origin, User-Agent, DNT, Cache-Control, X-Mx-ReqToken, Keep-Alive, X-Requested-With, If-Modified-Since, *" always;
|
|
add_header Access-Control-Max-Age 86400 always;
|
|
|
|
# Universal OPTIONS preflight handler
|
|
if ($request_method = OPTIONS) {
|
|
return 204;
|
|
}
|
|
|
|
# 1. SPECIFIC ENDPOINTS (most specific first)
|
|
|
|
# PUT /upload (BUD-02) - File uploads
|
|
location = /upload {
|
|
if ($request_method !~ ^(PUT|HEAD)$) {
|
|
return 405;
|
|
}
|
|
# CORS headers
|
|
add_header Access-Control-Allow-Origin * always;
|
|
add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, HEAD, OPTIONS, PATCH" always;
|
|
add_header Access-Control-Allow-Headers "Authorization, Content-Type, Content-Length, Accept, Origin, User-Agent, DNT, Cache-Control, X-Mx-ReqToken, Keep-Alive, X-Requested-With, If-Modified-Since, *" always;
|
|
add_header Access-Control-Max-Age 86400 always;
|
|
|
|
fastcgi_pass fastcgi_backend;
|
|
fastcgi_param QUERY_STRING $query_string;
|
|
fastcgi_param REQUEST_METHOD $request_method;
|
|
fastcgi_param CONTENT_TYPE $content_type;
|
|
fastcgi_param CONTENT_LENGTH $content_length;
|
|
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
|
|
fastcgi_param REQUEST_URI $request_uri;
|
|
fastcgi_param DOCUMENT_URI $document_uri;
|
|
fastcgi_param DOCUMENT_ROOT $document_root;
|
|
fastcgi_param SERVER_PROTOCOL $server_protocol;
|
|
fastcgi_param REQUEST_SCHEME $scheme;
|
|
fastcgi_param HTTPS $https if_not_empty;
|
|
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
|
|
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
|
|
fastcgi_param REMOTE_ADDR $remote_addr;
|
|
fastcgi_param REMOTE_PORT $remote_port;
|
|
fastcgi_param SERVER_ADDR $server_addr;
|
|
fastcgi_param SERVER_PORT $server_port;
|
|
fastcgi_param SERVER_NAME $server_name;
|
|
fastcgi_param REDIRECT_STATUS 200;
|
|
fastcgi_param SCRIPT_FILENAME $document_root/ginxsom.fcgi;
|
|
fastcgi_param HTTP_AUTHORIZATION $http_authorization;
|
|
}
|
|
|
|
# GET /list/<pubkey> (BUD-02) - List user's blobs
|
|
location ~ "^/list/([a-f0-9]{64})$" {
|
|
if ($request_method !~ ^(GET)$) {
|
|
return 405;
|
|
}
|
|
fastcgi_pass fastcgi_backend;
|
|
fastcgi_param QUERY_STRING $query_string;
|
|
fastcgi_param REQUEST_METHOD $request_method;
|
|
fastcgi_param CONTENT_TYPE $content_type;
|
|
fastcgi_param CONTENT_LENGTH $content_length;
|
|
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
|
|
fastcgi_param REQUEST_URI $request_uri;
|
|
fastcgi_param DOCUMENT_URI $document_uri;
|
|
fastcgi_param DOCUMENT_ROOT $document_root;
|
|
fastcgi_param SERVER_PROTOCOL $server_protocol;
|
|
fastcgi_param REQUEST_SCHEME $scheme;
|
|
fastcgi_param HTTPS $https if_not_empty;
|
|
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
|
|
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
|
|
fastcgi_param REMOTE_ADDR $remote_addr;
|
|
fastcgi_param REMOTE_PORT $remote_port;
|
|
fastcgi_param SERVER_ADDR $server_addr;
|
|
fastcgi_param SERVER_PORT $server_port;
|
|
fastcgi_param SERVER_NAME $server_name;
|
|
fastcgi_param REDIRECT_STATUS 200;
|
|
fastcgi_param SCRIPT_FILENAME $document_root/ginxsom.fcgi;
|
|
fastcgi_param HTTP_AUTHORIZATION $http_authorization;
|
|
}
|
|
|
|
# PUT /mirror (BUD-04) - Mirror content
|
|
location = /mirror {
|
|
if ($request_method !~ ^(PUT)$) {
|
|
return 405;
|
|
}
|
|
fastcgi_pass fastcgi_backend;
|
|
fastcgi_param QUERY_STRING $query_string;
|
|
fastcgi_param REQUEST_METHOD $request_method;
|
|
fastcgi_param CONTENT_TYPE $content_type;
|
|
fastcgi_param CONTENT_LENGTH $content_length;
|
|
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
|
|
fastcgi_param REQUEST_URI $request_uri;
|
|
fastcgi_param DOCUMENT_URI $document_uri;
|
|
fastcgi_param DOCUMENT_ROOT $document_root;
|
|
fastcgi_param SERVER_PROTOCOL $server_protocol;
|
|
fastcgi_param REQUEST_SCHEME $scheme;
|
|
fastcgi_param HTTPS $https if_not_empty;
|
|
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
|
|
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
|
|
fastcgi_param REMOTE_ADDR $remote_addr;
|
|
fastcgi_param REMOTE_PORT $remote_port;
|
|
fastcgi_param SERVER_ADDR $server_addr;
|
|
fastcgi_param SERVER_PORT $server_port;
|
|
fastcgi_param SERVER_NAME $server_name;
|
|
fastcgi_param REDIRECT_STATUS 200;
|
|
fastcgi_param SCRIPT_FILENAME $document_root/ginxsom.fcgi;
|
|
fastcgi_param HTTP_AUTHORIZATION $http_authorization;
|
|
}
|
|
|
|
# PUT /report (BUD-09) - Report content
|
|
location = /report {
|
|
if ($request_method !~ ^(PUT)$) {
|
|
return 405;
|
|
}
|
|
fastcgi_pass fastcgi_backend;
|
|
fastcgi_param QUERY_STRING $query_string;
|
|
fastcgi_param REQUEST_METHOD $request_method;
|
|
fastcgi_param CONTENT_TYPE $content_type;
|
|
fastcgi_param CONTENT_LENGTH $content_length;
|
|
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
|
|
fastcgi_param REQUEST_URI $request_uri;
|
|
fastcgi_param DOCUMENT_URI $document_uri;
|
|
fastcgi_param DOCUMENT_ROOT $document_root;
|
|
fastcgi_param SERVER_PROTOCOL $server_protocol;
|
|
fastcgi_param REQUEST_SCHEME $scheme;
|
|
fastcgi_param HTTPS $https if_not_empty;
|
|
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
|
|
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
|
|
fastcgi_param REMOTE_ADDR $remote_addr;
|
|
fastcgi_param REMOTE_PORT $remote_port;
|
|
fastcgi_param SERVER_ADDR $server_addr;
|
|
fastcgi_param SERVER_PORT $server_port;
|
|
fastcgi_param SERVER_NAME $server_name;
|
|
fastcgi_param REDIRECT_STATUS 200;
|
|
fastcgi_param SCRIPT_FILENAME $document_root/ginxsom.fcgi;
|
|
fastcgi_param HTTP_AUTHORIZATION $http_authorization;
|
|
}
|
|
|
|
# GET /auth (NIP-42) - Challenge generation
|
|
location = /auth {
|
|
if ($request_method !~ ^(GET)$) {
|
|
return 405;
|
|
}
|
|
fastcgi_pass fastcgi_backend;
|
|
fastcgi_param QUERY_STRING $query_string;
|
|
fastcgi_param REQUEST_METHOD $request_method;
|
|
fastcgi_param CONTENT_TYPE $content_type;
|
|
fastcgi_param CONTENT_LENGTH $content_length;
|
|
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
|
|
fastcgi_param REQUEST_URI $request_uri;
|
|
fastcgi_param DOCUMENT_URI $document_uri;
|
|
fastcgi_param DOCUMENT_ROOT $document_root;
|
|
fastcgi_param SERVER_PROTOCOL $server_protocol;
|
|
fastcgi_param REQUEST_SCHEME $scheme;
|
|
fastcgi_param HTTPS $https if_not_empty;
|
|
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
|
|
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
|
|
fastcgi_param REMOTE_ADDR $remote_addr;
|
|
fastcgi_param REMOTE_PORT $remote_port;
|
|
fastcgi_param SERVER_ADDR $server_addr;
|
|
fastcgi_param SERVER_PORT $server_port;
|
|
fastcgi_param SERVER_NAME $server_name;
|
|
fastcgi_param REDIRECT_STATUS 200;
|
|
fastcgi_param SCRIPT_FILENAME $document_root/ginxsom.fcgi;
|
|
fastcgi_param HTTP_AUTHORIZATION $http_authorization;
|
|
}
|
|
|
|
# Admin web interface (/admin)
|
|
location /admin {
|
|
if ($request_method !~ ^(GET)$) {
|
|
return 405;
|
|
}
|
|
fastcgi_pass fastcgi_backend;
|
|
fastcgi_param QUERY_STRING $query_string;
|
|
fastcgi_param REQUEST_METHOD $request_method;
|
|
fastcgi_param CONTENT_TYPE $content_type;
|
|
fastcgi_param CONTENT_LENGTH $content_length;
|
|
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
|
|
fastcgi_param REQUEST_URI $request_uri;
|
|
fastcgi_param DOCUMENT_URI $document_uri;
|
|
fastcgi_param DOCUMENT_ROOT $document_root;
|
|
fastcgi_param SERVER_PROTOCOL $server_protocol;
|
|
fastcgi_param REQUEST_SCHEME $scheme;
|
|
fastcgi_param HTTPS $https if_not_empty;
|
|
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
|
|
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
|
|
fastcgi_param REMOTE_ADDR $remote_addr;
|
|
fastcgi_param REMOTE_PORT $remote_port;
|
|
fastcgi_param SERVER_ADDR $server_addr;
|
|
fastcgi_param SERVER_PORT $server_port;
|
|
fastcgi_param SERVER_NAME $server_name;
|
|
fastcgi_param REDIRECT_STATUS 200;
|
|
fastcgi_param SCRIPT_FILENAME $document_root/ginxsom.fcgi;
|
|
fastcgi_param HTTP_AUTHORIZATION $http_authorization;
|
|
}
|
|
|
|
# Admin API endpoints (/api/*)
|
|
location /api/ {
|
|
if ($request_method !~ ^(GET|PUT|POST)$) {
|
|
return 405;
|
|
}
|
|
fastcgi_pass fastcgi_backend;
|
|
fastcgi_param QUERY_STRING $query_string;
|
|
fastcgi_param REQUEST_METHOD $request_method;
|
|
fastcgi_param CONTENT_TYPE $content_type;
|
|
fastcgi_param CONTENT_LENGTH $content_length;
|
|
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
|
|
fastcgi_param REQUEST_URI $request_uri;
|
|
fastcgi_param DOCUMENT_URI $document_uri;
|
|
fastcgi_param DOCUMENT_ROOT $document_root;
|
|
fastcgi_param SERVER_PROTOCOL $server_protocol;
|
|
fastcgi_param REQUEST_SCHEME $scheme;
|
|
fastcgi_param HTTPS $https if_not_empty;
|
|
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
|
|
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
|
|
fastcgi_param REMOTE_ADDR $remote_addr;
|
|
fastcgi_param REMOTE_PORT $remote_port;
|
|
fastcgi_param SERVER_ADDR $server_addr;
|
|
fastcgi_param SERVER_PORT $server_port;
|
|
fastcgi_param SERVER_NAME $server_name;
|
|
fastcgi_param REDIRECT_STATUS 200;
|
|
fastcgi_param SCRIPT_FILENAME $document_root/ginxsom.fcgi;
|
|
fastcgi_param HTTP_AUTHORIZATION $http_authorization;
|
|
}
|
|
|
|
# 2. BLOB OPERATIONS (SHA256 patterns)
|
|
|
|
# GET/HEAD/DELETE /<sha256> (BUD-01) - Blob operations with optional file extensions
|
|
location ~ "^/([a-f0-9]{64})(\.[a-zA-Z0-9]+)?$" {
|
|
# Handle DELETE method via rewrite to avoid fastcgi_param in if block
|
|
if ($request_method = DELETE) {
|
|
rewrite ^/(.*)$ /fcgi-delete/$1 last;
|
|
}
|
|
|
|
# Route HEAD requests to FastCGI for metadata
|
|
if ($request_method = HEAD) {
|
|
rewrite ^/(.*)$ /fcgi-head/$1 last;
|
|
}
|
|
|
|
# Only allow GET for file serving at this point
|
|
if ($request_method != GET) {
|
|
return 405;
|
|
}
|
|
|
|
# GET requests - serve files directly with extension fallback
|
|
try_files /$1.txt /$1.jpg /$1.jpeg /$1.png /$1.webp /$1.gif /$1.pdf /$1.mp4 /$1.mp3 /$1.md =404;
|
|
|
|
# Cache headers for blob content
|
|
add_header Cache-Control "public, max-age=31536000, immutable";
|
|
add_header Access-Control-Allow-Origin * always;
|
|
add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, HEAD, OPTIONS, PATCH" always;
|
|
add_header Access-Control-Allow-Headers "Authorization, Content-Type, Content-Length, Accept, Origin, User-Agent, DNT, Cache-Control, X-Mx-ReqToken, Keep-Alive, X-Requested-With, If-Modified-Since, *" always;
|
|
add_header Access-Control-Max-Age 86400 always;
|
|
}
|
|
|
|
# Internal handler for DELETE operations
|
|
location ~ "^/fcgi-delete/([a-f0-9]{64}).*$" {
|
|
internal;
|
|
fastcgi_pass fastcgi_backend;
|
|
fastcgi_param QUERY_STRING $query_string;
|
|
fastcgi_param REQUEST_METHOD DELETE;
|
|
fastcgi_param CONTENT_TYPE $content_type;
|
|
fastcgi_param CONTENT_LENGTH $content_length;
|
|
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
|
|
fastcgi_param REQUEST_URI /$1;
|
|
fastcgi_param DOCUMENT_URI /$1;
|
|
fastcgi_param DOCUMENT_ROOT $document_root;
|
|
fastcgi_param SERVER_PROTOCOL $server_protocol;
|
|
fastcgi_param REQUEST_SCHEME $scheme;
|
|
fastcgi_param HTTPS $https if_not_empty;
|
|
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
|
|
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
|
|
fastcgi_param REMOTE_ADDR $remote_addr;
|
|
fastcgi_param REMOTE_PORT $remote_port;
|
|
fastcgi_param SERVER_ADDR $server_addr;
|
|
fastcgi_param SERVER_PORT $server_port;
|
|
fastcgi_param SERVER_NAME $server_name;
|
|
fastcgi_param REDIRECT_STATUS 200;
|
|
fastcgi_param SCRIPT_FILENAME $document_root/ginxsom.fcgi;
|
|
fastcgi_param HTTP_AUTHORIZATION $http_authorization;
|
|
}
|
|
|
|
# FastCGI handler for HEAD requests
|
|
location ~ "^/fcgi-head/([a-f0-9]{64}).*$" {
|
|
internal;
|
|
fastcgi_pass fastcgi_backend;
|
|
fastcgi_param QUERY_STRING $query_string;
|
|
fastcgi_param REQUEST_METHOD HEAD;
|
|
fastcgi_param CONTENT_TYPE $content_type;
|
|
fastcgi_param CONTENT_LENGTH $content_length;
|
|
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
|
|
fastcgi_param REQUEST_URI /$1;
|
|
fastcgi_param DOCUMENT_URI /$1;
|
|
fastcgi_param DOCUMENT_ROOT $document_root;
|
|
fastcgi_param SERVER_PROTOCOL $server_protocol;
|
|
fastcgi_param REQUEST_SCHEME $scheme;
|
|
fastcgi_param HTTPS $https if_not_empty;
|
|
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
|
|
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
|
|
fastcgi_param REMOTE_ADDR $remote_addr;
|
|
fastcgi_param REMOTE_PORT $remote_port;
|
|
fastcgi_param SERVER_ADDR $server_addr;
|
|
fastcgi_param SERVER_PORT $server_port;
|
|
fastcgi_param SERVER_NAME $server_name;
|
|
fastcgi_param REDIRECT_STATUS 200;
|
|
fastcgi_param SCRIPT_FILENAME $document_root/ginxsom.fcgi;
|
|
fastcgi_param HTTP_AUTHORIZATION $http_authorization;
|
|
}
|
|
|
|
# 3. UTILITY ENDPOINTS
|
|
|
|
# Health check endpoint
|
|
location /health {
|
|
access_log off;
|
|
return 200 "OK (HTTPS)\n";
|
|
add_header Content-Type text/plain;
|
|
add_header Access-Control-Allow-Origin * always;
|
|
add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, HEAD, OPTIONS, PATCH" always;
|
|
add_header Access-Control-Allow-Headers "Authorization, Content-Type, Content-Length, Accept, Origin, User-Agent, DNT, Cache-Control, X-Mx-ReqToken, Keep-Alive, X-Requested-With, If-Modified-Since, *" always;
|
|
add_header Access-Control-Max-Age 86400 always;
|
|
}
|
|
|
|
# List files endpoint for debugging
|
|
location /debug/list {
|
|
autoindex on;
|
|
autoindex_format json;
|
|
}
|
|
|
|
# Root endpoint - Server info from FastCGI
|
|
location = / {
|
|
if ($request_method !~ ^(GET)$) {
|
|
return 405;
|
|
}
|
|
fastcgi_pass fastcgi_backend;
|
|
fastcgi_param QUERY_STRING $query_string;
|
|
fastcgi_param REQUEST_METHOD $request_method;
|
|
fastcgi_param CONTENT_TYPE $content_type;
|
|
fastcgi_param CONTENT_LENGTH $content_length;
|
|
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
|
|
fastcgi_param REQUEST_URI $request_uri;
|
|
fastcgi_param DOCUMENT_URI $document_uri;
|
|
fastcgi_param DOCUMENT_ROOT $document_root;
|
|
fastcgi_param SERVER_PROTOCOL $server_protocol;
|
|
fastcgi_param REQUEST_SCHEME $scheme;
|
|
fastcgi_param HTTPS $https if_not_empty;
|
|
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
|
|
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
|
|
fastcgi_param REMOTE_ADDR $remote_addr;
|
|
fastcgi_param REMOTE_PORT $remote_port;
|
|
fastcgi_param SERVER_ADDR $server_addr;
|
|
fastcgi_param SERVER_PORT $server_port;
|
|
fastcgi_param SERVER_NAME $server_name;
|
|
fastcgi_param REDIRECT_STATUS 200;
|
|
fastcgi_param SCRIPT_FILENAME $document_root/ginxsom.fcgi;
|
|
fastcgi_param HTTP_AUTHORIZATION $http_authorization;
|
|
}
|
|
}
|
|
}
|