Replace master branch with local files

openresty/nginx.conf

@@ -0,0 +1,450 @@
+worker_processes auto;
+error_log stderr warn;
+
+# Run worker processes as nobody user (master process remains root for port binding)
+user nobody nogroup;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    include mime.types;
+    default_type application/octet-stream;
+    
+    # Temp directories
+    client_body_temp_path /var/cache/nginx/client_temp;
+    proxy_temp_path /var/cache/nginx/proxy_temp;
+    fastcgi_temp_path /var/cache/nginx/fastcgi_temp;
+    uwsgi_temp_path /var/cache/nginx/uwsgi_temp;
+    scgi_temp_path /var/cache/nginx/scgi_temp;
+    
+    # Docker DNS resolver
+    resolver 127.0.0.11 valid=30s;
+    
+    lua_package_path "/usr/local/openresty/nginx/lua/?.lua;;";
+    lua_shared_dict stream_keys 10m;
+    lua_shared_dict rate_limit 10m;
+    
+    # Enable compression
+    gzip on;
+    gzip_vary on;
+    gzip_min_length 1024;
+    gzip_types text/plain text/css text/xml text/javascript application/javascript application/json application/xml+rss image/svg+xml;
+    
+    # Security headers
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    
+    # Map to handle CORS origin properly
+    map $http_origin $cors_origin {
+        default "";
+        "~^https?://localhost(:[0-9]+)?$" $http_origin;
+        "~^https?://127\.0\.0\.1(:[0-9]+)?$" $http_origin;
+        "~^https?://\[::1\](:[0-9]+)?$" $http_origin;
+    }
+    
+    upstream backend {
+        server drogon-backend:8080;
+    }
+    
+    upstream frontend {
+        server sveltekit:3000;
+    }
+    
+    upstream ome {
+        server ovenmediaengine:8080;
+    }
+    
+    # Rate limiting zones
+    limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;
+    limit_req_zone $binary_remote_addr zone=auth_limit:10m rate=3r/m;
+    limit_req_zone $binary_remote_addr zone=register_limit:10m rate=1r/m;
+    
+    # Increase client max body size for avatar uploads
+    client_max_body_size 1m;
+    
+    server {
+        listen 80;
+        server_name localhost;
+        
+        # Security headers for the whole server
+        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+        
+        # Fixed: Serve uploaded files with correct configuration
+        location /uploads/ {
+            # Use root directive with absolute path to avoid alias+try_files bug
+            root /app;
+            
+            # Security settings
+            autoindex off;
+            add_header X-Content-Type-Options "nosniff" always;
+            
+            # Only serve files, not directories
+            try_files $uri =404;
+            
+            # Cache static images
+            location ~* \.(jpg|jpeg|png|gif|webp|svg)$ {
+                expires 30d;
+                add_header Cache-Control "public, immutable" always;
+                add_header X-Content-Type-Options "nosniff" always;
+            }
+        }
+        
+        # SvelteKit immutable assets (with content hashes)
+        location ~ ^/_app/immutable/ {
+            proxy_pass http://frontend;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            
+            # Long cache for immutable assets
+            proxy_cache_valid 200 1y;
+            expires 1y;
+            add_header Cache-Control "public, immutable" always;
+            access_log off;
+        }
+        
+        # SvelteKit mutable assets
+        location ~ ^/_app/ {
+            proxy_pass http://frontend;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            
+            # Short cache for mutable assets
+            expires 1h;
+            add_header Cache-Control "public, max-age=3600" always;
+        }
+        
+        # Authentication endpoints with strict rate limiting
+        location = /api/auth/register {
+            limit_req zone=register_limit burst=2 nodelay;
+            
+            # CORS headers
+            add_header Access-Control-Allow-Origin $cors_origin always;
+            add_header Access-Control-Allow-Methods "POST, OPTIONS" always;
+            add_header Access-Control-Allow-Headers "Content-Type" always;
+            add_header Access-Control-Allow-Credentials "true" always;
+            
+            if ($request_method = 'OPTIONS') {
+                add_header Content-Length 0;
+                add_header Content-Type text/plain;
+                return 204;
+            }
+            
+            proxy_pass http://backend;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+        
+        location = /api/auth/login {
+            limit_req zone=auth_limit burst=5 nodelay;
+            
+            # CORS headers
+            add_header Access-Control-Allow-Origin $cors_origin always;
+            add_header Access-Control-Allow-Methods "POST, OPTIONS" always;
+            add_header Access-Control-Allow-Headers "Content-Type" always;
+            add_header Access-Control-Allow-Credentials "true" always;
+            
+            if ($request_method = 'OPTIONS') {
+                add_header Content-Length 0;
+                add_header Content-Type text/plain;
+                return 204;
+            }
+            
+            proxy_pass http://backend;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+        
+        location ~ ^/api/auth/(pgp-challenge|pgp-verify) {
+            limit_req zone=auth_limit burst=5 nodelay;
+            
+            # CORS headers
+            add_header Access-Control-Allow-Origin $cors_origin always;
+            add_header Access-Control-Allow-Methods "POST, OPTIONS" always;
+            add_header Access-Control-Allow-Headers "Content-Type" always;
+            add_header Access-Control-Allow-Credentials "true" always;
+            
+            if ($request_method = 'OPTIONS') {
+                add_header Content-Length 0;
+                add_header Content-Type text/plain;
+                return 204;
+            }
+            
+            proxy_pass http://backend;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+        
+        # Public user profile endpoints - no authentication required
+        location ~ ^/api/users/[^/]+/?$ {
+            # CORS headers
+            add_header Access-Control-Allow-Origin $cors_origin always;
+            add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+            add_header Access-Control-Allow-Headers "Content-Type" always;
+            add_header Access-Control-Allow-Credentials "true" always;
+            
+            if ($request_method = 'OPTIONS') {
+                add_header Content-Length 0;
+                add_header Content-Type text/plain;
+                return 204;
+            }
+            
+            proxy_pass http://backend;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            
+            # Cache public profiles for a short time
+            expires 1m;
+            add_header Cache-Control "public, max-age=60" always;
+        }
+        
+        # Public user PGP keys endpoints - no authentication required
+        location ~ ^/api/users/[^/]+/pgp-keys$ {
+            # CORS headers
+            add_header Access-Control-Allow-Origin $cors_origin always;
+            add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+            add_header Access-Control-Allow-Headers "Content-Type" always;
+            add_header Access-Control-Allow-Credentials "true" always;
+            
+            if ($request_method = 'OPTIONS') {
+                add_header Content-Length 0;
+                add_header Content-Type text/plain;
+                return 204;
+            }
+            
+            proxy_pass http://backend;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            
+            # Cache PGP keys for a bit longer as they change less frequently
+            expires 5m;
+            add_header Cache-Control "public, max-age=300" always;
+        }
+        
+        # Public realm endpoints (with viewer token authentication for stream-key)
+        location ~ ^/api/realms/(by-name/[^/]+|live|[0-9]+/stats|[0-9]+/viewer-token|[0-9]+/stream-key)$ {
+            # CORS headers
+            add_header Access-Control-Allow-Origin $cors_origin always;
+            add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+            add_header Access-Control-Allow-Headers "Content-Type" always;
+            add_header Access-Control-Allow-Credentials "true" always;
+            
+            if ($request_method = 'OPTIONS') {
+                add_header Content-Length 0;
+                add_header Content-Type text/plain;
+                return 204;
+            }
+            
+            proxy_pass http://backend;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header Cookie $http_cookie;
+            
+            # Short cache for live realm data
+            expires 10s;
+            add_header Cache-Control "public, max-age=10" always;
+        }
+        
+        # Public stream endpoints (some require viewer tokens)
+        location ~ ^/api/stream/(heartbeat/[^/]+)$ {
+            # CORS headers
+            add_header Access-Control-Allow-Origin $cors_origin always;
+            add_header Access-Control-Allow-Methods "POST, OPTIONS" always;
+            add_header Access-Control-Allow-Headers "Content-Type" always;
+            add_header Access-Control-Allow-Credentials "true" always;
+            
+            if ($request_method = 'OPTIONS') {
+                add_header Content-Length 0;
+                add_header Content-Type text/plain;
+                return 204;
+            }
+            
+            proxy_pass http://backend;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header Cookie $http_cookie;
+        }
+        
+        # Other API endpoints (authenticated)
+        location /api/ {
+            limit_req zone=api_limit burst=20 nodelay;
+            
+            # CORS headers
+            add_header Access-Control-Allow-Origin $cors_origin always;
+            add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS" always;
+            add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
+            add_header Access-Control-Allow-Credentials "true" always;
+            
+            # Handle preflight
+            if ($request_method = 'OPTIONS') {
+                add_header Content-Length 0;
+                add_header Content-Type text/plain;
+                return 204;
+            }
+            
+            proxy_pass http://backend;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header Cookie $http_cookie;
+            
+            # Don't cache API responses
+            expires -1;
+            add_header Cache-Control "no-store, no-cache, must-revalidate" always;
+        }
+        
+        # WebSocket
+        location /ws/ {
+            proxy_pass http://backend;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header Cookie $http_cookie;
+            
+            # WebSocket timeouts
+            proxy_read_timeout 3600s;
+            proxy_send_timeout 3600s;
+        }
+        
+        # Frontend (all other requests)
+        location / {
+            proxy_pass http://frontend;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            
+            # Enable HTTP/1.1 for keep-alive
+            proxy_http_version 1.1;
+            proxy_set_header Connection "";
+        }
+    }
+    
+    # Separate server block for port 8088 (HLS/LLHLS)
+    server {
+        listen 8088;
+        server_name localhost;
+        
+        # Security headers
+        add_header X-Content-Type-Options "nosniff" always;
+        
+        # Token validation for HLS/LLHLS playlists and segments
+        location ~ ^/app/([^/]+)/(.*\.(m3u8|ts|m4s))$ {
+            set $stream_key $1;
+            set $file_path $2;
+            
+            # CORS headers
+            add_header Access-Control-Allow-Origin $cors_origin always;
+            add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+            add_header Access-Control-Allow-Headers "Range" always;
+            add_header Access-Control-Allow-Credentials "true" always;
+            add_header Access-Control-Expose-Headers "Content-Length,Content-Range" always;
+            
+            # Handle preflight
+            if ($request_method = 'OPTIONS') {
+                add_header Content-Length 0;
+                add_header Content-Type text/plain;
+                return 204;
+            }
+            
+            # Access control via Lua
+            access_by_lua_block {
+                local redis_helper = require "redis_helper"
+                
+                -- Get viewer token from cookie
+                local cookie_header = ngx.var.http_cookie
+                if not cookie_header then
+                    ngx.status = ngx.HTTP_FORBIDDEN
+                    ngx.say("No authentication token")
+                    return ngx.exit(ngx.HTTP_FORBIDDEN)
+                end
+                
+                -- Extract viewer_token cookie
+                local token = nil
+                -- Handle URL-encoded cookies and spaces
+                cookie_header = ngx.unescape_uri(cookie_header)
+                for k, v in string.gmatch(cookie_header, "([^=]+)=([^;]+)") do
+                    k = k:match("^%s*(.-)%s*$") -- trim whitespace
+                    if k == "viewer_token" then
+                        token = v:match("^%s*(.-)%s*$") -- trim whitespace
+                        break
+                    end
+                end
+                
+                if not token then
+                    ngx.status = ngx.HTTP_FORBIDDEN
+                    ngx.say("Missing viewer token")
+                    return ngx.exit(ngx.HTTP_FORBIDDEN)
+                end
+                
+                -- Validate token
+                local valid_stream = redis_helper.validate_viewer_token(token, ngx.var.stream_key)
+                if not valid_stream then
+                    ngx.status = ngx.HTTP_FORBIDDEN
+                    ngx.say("Invalid viewer token")
+                    return ngx.exit(ngx.HTTP_FORBIDDEN)
+                end
+                
+                -- Optionally refresh token TTL on segment access
+                redis_helper.refresh_viewer_token(token)
+            }
+            
+            # Cache settings for segments
+            location ~ \.ts$ {
+                expires 1h;
+                add_header Cache-Control "public, max-age=3600" always;
+            }
+            
+            # Don't cache playlists
+            location ~ \.m3u8$ {
+                expires -1;
+                add_header Cache-Control "no-cache, no-store, must-revalidate" always;
+            }
+            
+            # Proxy to OvenMediaEngine
+            proxy_pass http://ome/app/$stream_key/$file_path;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        }
+        
+        # Public access for stream info
+        location / {
+            # CORS headers
+            add_header Access-Control-Allow-Origin $cors_origin always;
+            add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+            add_header Access-Control-Allow-Credentials "true" always;
+            
+            proxy_pass http://ome;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        }
+    }
+}