From c1b934a582c6e4a2a7a974c3d2662341eac8bd97 Mon Sep 17 00:00:00 2001 From: Arnaud Botella Date: Thu, 6 Aug 2026 12:16:07 +0200 Subject: [PATCH 1/3] refacto nginx --- Dockerfile | 9 +- nginx.conf | 140 ------------------ nginx/locations/geode.conf | 32 ++++ nginx/locations/server.conf | 32 ++++ nginx/locations/viewer.conf | 32 ++++ nginx/nginx.conf | 44 ++++++ .../conf.d/cleanup.conf | 0 {supervisor => supervisord}/conf.d/nginx.conf | 0 {supervisor => supervisord}/supervisord.conf | 0 9 files changed, 143 insertions(+), 146 deletions(-) delete mode 100644 nginx.conf create mode 100644 nginx/locations/geode.conf create mode 100644 nginx/locations/server.conf create mode 100644 nginx/locations/viewer.conf create mode 100644 nginx/nginx.conf rename {supervisor => supervisord}/conf.d/cleanup.conf (100%) rename {supervisor => supervisord}/conf.d/nginx.conf (100%) rename {supervisor => supervisord}/supervisord.conf (100%) diff --git a/Dockerfile b/Dockerfile index f87a996..ffdbc7b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -2,15 +2,12 @@ FROM nginx:alpine RUN apk add curl jq bash supervisor -COPY nginx.conf /etc/nginx/nginx.conf +COPY nginx /etc/nginx -COPY supervisor/supervisord.conf /etc/supervisord.conf +COPY supervisord /etc/supervisord RUN mkdir -p /var/log/supervisor -RUN mkdir -p /etc/supervisor/conf.d - -COPY supervisor/conf.d /etc/supervisor/conf.d COPY cleanup.bash /usr/local/bin/cleanup.bash RUN chmod +x /usr/local/bin/cleanup.bash -CMD ["/usr/bin/supervisord", "-c", "/etc/supervisord.conf"] \ No newline at end of file +CMD ["/usr/bin/supervisord", "-c", "/etc/supervisord/supervisord.conf"] \ No newline at end of file diff --git a/nginx.conf b/nginx.conf deleted file mode 100644 index d15f0ba..0000000 --- a/nginx.conf +++ /dev/null @@ -1,140 +0,0 @@ -events { - worker_connections 1024; -} - -http { - # Map only allows your geode-solutions.com domains (including next.vease.geode-solutions.com) - map $http_origin $allow_origin { - ~^https://(.*\.)?geode-solutions\.com$ $http_origin; - default ""; - } - - gzip on; - gzip_proxied any; - gzip_types text/plain application/json; - gzip_min_length 1000; - - server { - listen 80; - server_name localhost; - client_max_body_size 0; - - # ====================== /geode/ location ====================== - location ~ "^/geode/" { - # Preflight OPTIONS - handled by nginx (fast, no hit to Flask) - if ($request_method = 'OPTIONS') { - add_header 'Access-Control-Allow-Origin' $allow_origin always; - add_header 'Access-Control-Allow-Credentials' 'true' always; - add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, PATCH, OPTIONS' always; - add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,X-CSRF-Token' always; - add_header 'Access-Control-Max-Age' 1728000 always; # 20 days - add_header 'Content-Type' 'text/plain; charset=utf-8'; - add_header 'Content-Length' 0; - return 204; - } - - # Normal requests - limit_except DELETE GET POST PUT OPTIONS { deny all; } - - add_header 'Access-Control-Allow-Origin' $allow_origin always; - add_header 'Access-Control-Allow-Credentials' 'true' always; - add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, PATCH, OPTIONS' always; - add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,X-CSRF-Token' always; - add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range' always; - add_header 'Vary' 'Origin' always; - - rewrite "^/geode/(.*)" /$1 break; - proxy_pass http://localhost:5000; - proxy_http_version 1.1; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - } - - # ====================== /viewer/ location ====================== - location ~ "^/viewer/" { - if ($request_method = 'OPTIONS') { - add_header 'Access-Control-Allow-Origin' $allow_origin always; - add_header 'Access-Control-Allow-Credentials' 'true' always; - add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, PATCH, OPTIONS' always; - add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,X-CSRF-Token' always; - add_header 'Access-Control-Max-Age' 1728000 always; - add_header 'Content-Type' 'text/plain; charset=utf-8'; - add_header 'Content-Length' 0; - return 204; - } - - limit_except GET POST OPTIONS { deny all; } - - add_header 'Access-Control-Allow-Origin' $allow_origin always; - add_header 'Access-Control-Allow-Credentials' 'true' always; - add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, PATCH, OPTIONS' always; - add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,X-CSRF-Token' always; - add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range' always; - add_header 'Vary' 'Origin' always; - - rewrite "^/viewer/(.*)" /$1 break; - proxy_pass http://localhost:1234; - proxy_http_version 1.1; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - proxy_set_header Connection "keep-alive, Upgrade"; - proxy_set_header Upgrade websocket; - } - - # ====================== /server/ location ====================== - location ~ "^/server/" { - # Preflight OPTIONS - handled by nginx (fast, no hit to Flask) - if ($request_method = 'OPTIONS') { - add_header 'Access-Control-Allow-Origin' $allow_origin always; - add_header 'Access-Control-Allow-Credentials' 'true' always; - add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, PATCH, OPTIONS' always; - add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,X-CSRF-Token' always; - add_header 'Access-Control-Max-Age' 1728000 always; # 20 days - add_header 'Content-Type' 'text/plain; charset=utf-8'; - add_header 'Content-Length' 0; - return 204; - } - - # Normal requests - limit_except DELETE GET POST PUT OPTIONS { deny all; } - - add_header 'Access-Control-Allow-Origin' $allow_origin always; - add_header 'Access-Control-Allow-Credentials' 'true' always; - add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, PATCH, OPTIONS' always; - add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,X-CSRF-Token' always; - add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range' always; - add_header 'Vary' 'Origin' always; - - rewrite "^/server/(.*)" /$1 break; - proxy_pass http://localhost:3000; - proxy_http_version 1.1; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - } - - # Catch-all for anything else (optional, returns proper CORS even on 404) - location / { - if ($request_method = 'OPTIONS') { - add_header 'Access-Control-Allow-Origin' $allow_origin always; - add_header 'Access-Control-Allow-Credentials' 'true' always; - add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, PATCH, OPTIONS' always; - add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,X-CSRF-Token' always; - add_header 'Access-Control-Max-Age' 1728000 always; - add_header 'Content-Type' 'text/plain; charset=utf-8'; - add_header 'Content-Length' 0; - return 204; - } - - add_header 'Access-Control-Allow-Origin' $allow_origin always; - add_header 'Access-Control-Allow-Credentials' 'true' always; - add_header 'Vary' 'Origin' always; - return 404; - } - } -} diff --git a/nginx/locations/geode.conf b/nginx/locations/geode.conf new file mode 100644 index 0000000..957dc3c --- /dev/null +++ b/nginx/locations/geode.conf @@ -0,0 +1,32 @@ +# ====================== /geode/ location ====================== +location ~ "^/geode/" { + # Preflight OPTIONS - handled by nginx (fast, no hit to Flask) + if ($request_method = 'OPTIONS') { + add_header 'Access-Control-Allow-Origin' $allow_origin always; + add_header 'Access-Control-Allow-Credentials' 'true' always; + add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, PATCH, OPTIONS' always; + add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,X-CSRF-Token' always; + add_header 'Access-Control-Max-Age' 1728000 always; # 20 days + add_header 'Content-Type' 'text/plain; charset=utf-8'; + add_header 'Content-Length' 0; + return 204; + } + + # Normal requests + limit_except DELETE GET POST PUT OPTIONS { deny all; } + + add_header 'Access-Control-Allow-Origin' $allow_origin always; + add_header 'Access-Control-Allow-Credentials' 'true' always; + add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, PATCH, OPTIONS' always; + add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,X-CSRF-Token' always; + add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range' always; + add_header 'Vary' 'Origin' always; + + rewrite "^/geode/(.*)" /$1 break; + proxy_pass http://localhost:5000; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; +} \ No newline at end of file diff --git a/nginx/locations/server.conf b/nginx/locations/server.conf new file mode 100644 index 0000000..08ee053 --- /dev/null +++ b/nginx/locations/server.conf @@ -0,0 +1,32 @@ +# ====================== /server/ location ====================== +location ~ "^/server/" { + # Preflight OPTIONS - handled by nginx (fast, no hit to Flask) + if ($request_method = 'OPTIONS') { + add_header 'Access-Control-Allow-Origin' $allow_origin always; + add_header 'Access-Control-Allow-Credentials' 'true' always; + add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, PATCH, OPTIONS' always; + add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,X-CSRF-Token' always; + add_header 'Access-Control-Max-Age' 1728000 always; # 20 days + add_header 'Content-Type' 'text/plain; charset=utf-8'; + add_header 'Content-Length' 0; + return 204; + } + + # Normal requests + limit_except DELETE GET POST PUT OPTIONS { deny all; } + + add_header 'Access-Control-Allow-Origin' $allow_origin always; + add_header 'Access-Control-Allow-Credentials' 'true' always; + add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, PATCH, OPTIONS' always; + add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,X-CSRF-Token' always; + add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range' always; + add_header 'Vary' 'Origin' always; + + rewrite "^/server/(.*)" /$1 break; + proxy_pass http://localhost:3000; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; +} \ No newline at end of file diff --git a/nginx/locations/viewer.conf b/nginx/locations/viewer.conf new file mode 100644 index 0000000..6172089 --- /dev/null +++ b/nginx/locations/viewer.conf @@ -0,0 +1,32 @@ +# ====================== /viewer/ location ====================== +location ~ "^/viewer/" { + if ($request_method = 'OPTIONS') { + add_header 'Access-Control-Allow-Origin' $allow_origin always; + add_header 'Access-Control-Allow-Credentials' 'true' always; + add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, PATCH, OPTIONS' always; + add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,X-CSRF-Token' always; + add_header 'Access-Control-Max-Age' 1728000 always; + add_header 'Content-Type' 'text/plain; charset=utf-8'; + add_header 'Content-Length' 0; + return 204; + } + + limit_except GET POST OPTIONS { deny all; } + + add_header 'Access-Control-Allow-Origin' $allow_origin always; + add_header 'Access-Control-Allow-Credentials' 'true' always; + add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, PATCH, OPTIONS' always; + add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,X-CSRF-Token' always; + add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range' always; + add_header 'Vary' 'Origin' always; + + rewrite "^/viewer/(.*)" /$1 break; + proxy_pass http://localhost:1234; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header Connection "keep-alive, Upgrade"; + proxy_set_header Upgrade websocket; +} \ No newline at end of file diff --git a/nginx/nginx.conf b/nginx/nginx.conf new file mode 100644 index 0000000..7763af6 --- /dev/null +++ b/nginx/nginx.conf @@ -0,0 +1,44 @@ +events { + worker_connections 1024; +} + +http { + # Map only allows your geode-solutions.com domains (including next.vease.geode-solutions.com) + map $http_origin $allow_origin { + ~^https://(.*\.)?geode-solutions\.com$ $http_origin; + default ""; + } + + gzip on; + gzip_proxied any; + gzip_types text/plain application/json; + gzip_min_length 1000; + + server { + listen 80; + server_name localhost; + client_max_body_size 0; + + # ====================== dynamically managed locations ====================== + include /etc/nginx/locations/*.conf; + + # Catch-all for anything else (optional, returns proper CORS even on 404) + location / { + if ($request_method = 'OPTIONS') { + add_header 'Access-Control-Allow-Origin' $allow_origin always; + add_header 'Access-Control-Allow-Credentials' 'true' always; + add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, PATCH, OPTIONS' always; + add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,X-CSRF-Token' always; + add_header 'Access-Control-Max-Age' 1728000 always; + add_header 'Content-Type' 'text/plain; charset=utf-8'; + add_header 'Content-Length' 0; + return 204; + } + + add_header 'Access-Control-Allow-Origin' $allow_origin always; + add_header 'Access-Control-Allow-Credentials' 'true' always; + add_header 'Vary' 'Origin' always; + return 404; + } + } +} diff --git a/supervisor/conf.d/cleanup.conf b/supervisord/conf.d/cleanup.conf similarity index 100% rename from supervisor/conf.d/cleanup.conf rename to supervisord/conf.d/cleanup.conf diff --git a/supervisor/conf.d/nginx.conf b/supervisord/conf.d/nginx.conf similarity index 100% rename from supervisor/conf.d/nginx.conf rename to supervisord/conf.d/nginx.conf diff --git a/supervisor/supervisord.conf b/supervisord/supervisord.conf similarity index 100% rename from supervisor/supervisord.conf rename to supervisord/supervisord.conf From 744c44483c1c06750b1109953094546e5e4e40de Mon Sep 17 00:00:00 2001 From: Arnaud Botella Date: Thu, 6 Aug 2026 12:20:44 +0200 Subject: [PATCH 2/3] fix --- Dockerfile | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index ffdbc7b..cad854d 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,10 +4,13 @@ RUN apk add curl jq bash supervisor COPY nginx /etc/nginx -COPY supervisord /etc/supervisord +COPY supervisord/supervisord.conf /etc/supervisord.conf RUN mkdir -p /var/log/supervisor +RUN mkdir -p /etc/supervisor/conf.d + +COPY supervisord/conf.d /etc/supervisor/conf.d COPY cleanup.bash /usr/local/bin/cleanup.bash RUN chmod +x /usr/local/bin/cleanup.bash -CMD ["/usr/bin/supervisord", "-c", "/etc/supervisord/supervisord.conf"] \ No newline at end of file +CMD ["/usr/bin/supervisord", "-c", "/etc/supervisord.conf"] \ No newline at end of file From d5d408e81741c6d422bb33506f30f46f8908c41b Mon Sep 17 00:00:00 2001 From: Arnaud Botella Date: Thu, 6 Aug 2026 12:22:24 +0200 Subject: [PATCH 3/3] cleaner --- Dockerfile | 4 ++-- {supervisord => supervisor}/conf.d/cleanup.conf | 0 {supervisord => supervisor}/conf.d/nginx.conf | 0 {supervisord => supervisor}/supervisord.conf | 0 4 files changed, 2 insertions(+), 2 deletions(-) rename {supervisord => supervisor}/conf.d/cleanup.conf (100%) rename {supervisord => supervisor}/conf.d/nginx.conf (100%) rename {supervisord => supervisor}/supervisord.conf (100%) diff --git a/Dockerfile b/Dockerfile index cad854d..52fbcd9 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,11 +4,11 @@ RUN apk add curl jq bash supervisor COPY nginx /etc/nginx -COPY supervisord/supervisord.conf /etc/supervisord.conf +COPY supervisor/supervisord.conf /etc/supervisord.conf RUN mkdir -p /var/log/supervisor RUN mkdir -p /etc/supervisor/conf.d -COPY supervisord/conf.d /etc/supervisor/conf.d +COPY supervisor/conf.d /etc/supervisor/conf.d COPY cleanup.bash /usr/local/bin/cleanup.bash RUN chmod +x /usr/local/bin/cleanup.bash diff --git a/supervisord/conf.d/cleanup.conf b/supervisor/conf.d/cleanup.conf similarity index 100% rename from supervisord/conf.d/cleanup.conf rename to supervisor/conf.d/cleanup.conf diff --git a/supervisord/conf.d/nginx.conf b/supervisor/conf.d/nginx.conf similarity index 100% rename from supervisord/conf.d/nginx.conf rename to supervisor/conf.d/nginx.conf diff --git a/supervisord/supervisord.conf b/supervisor/supervisord.conf similarity index 100% rename from supervisord/supervisord.conf rename to supervisor/supervisord.conf