~bigbes/sourcehut-dolt

ref: 19645e70751196242d9c3bd4bdd002f43d89ee2a sourcehut-dolt/contrib/dolt.sr.ht.conf -rw-r--r-- 1.9 KiB
19645e70 — Eugene Blikh storage: bare store init/delete and remotesrv DBCache 30 days ago 
                                                                                
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64

# nginx site config for dolt.sr.ht, in the sr.ht-nginx style. Drop into the
# nginx sites dir alongside the other *.sr.ht.conf files; TLS/http2 and the
# shared proxy headers come from the included snippets (sourcehut.conf,
# port443.conf, port80.conf).
#
# Three back-end listeners are multiplexed by path:
#   - the remotesapi gRPC ChunkStoreService and its sealed-URL chunk data plane
#     -> 127.0.0.1:5306
#   - the CredentialsService (dolt login / keypair WhoAmI) -> 127.0.0.1:5308
#   - everything else (web UI + /static) -> 127.0.0.1:5307

server {
	include sourcehut.conf;
	include port80.conf;
	server_name dolt.srht.bigb.es;
}

server {
	include sourcehut.conf;
	include port443.conf;
	server_name dolt.srht.bigb.es;

	# dolt push can stream arbitrarily large table files.
	client_max_body_size 0;

	# remotesapi control plane: gRPC ChunkStoreService (clone/pull/push RPCs).
	# X-Forwarded-Proto must be set so the server hands back https:// sealed
	# chunk URLs (getScheme honors this header).
	location /dolt.services.remotesapi.v1alpha1.ChunkStoreService/ {
		grpc_pass grpc://127.0.0.1:5306;
		grpc_set_header X-Forwarded-Proto https;
		grpc_read_timeout 600s;
		grpc_send_timeout 600s;
		client_max_body_size 0;
	}

	# CredentialsService.WhoAmI: the `dolt login` keypair association flow.
	location /dolt.services.remotesapi.v1alpha1.CredentialsService/ {
		grpc_pass grpc://127.0.0.1:5308;
		grpc_set_header X-Forwarded-Proto https;
	}

	# Chunk data plane: AES-GCM sealed URLs (possession == authorization),
	# 15-minute expiry. GET on pull, PUT on push. No extra auth needed.
	location /single_symmetric_key_sealed_request/ {
		proxy_pass http://127.0.0.1:5306;
		client_max_body_size 0;
		proxy_request_buffering off;
		proxy_read_timeout 600s;
		proxy_send_timeout 600s;
	}

	# Web UI and /static.
	location / {
		proxy_pass http://127.0.0.1:5307;
		include headers.conf;
		include web.conf;
	}

	location /static {
		root /usr/share/sourcehut;
		expires 30d;
	}
}