commit 2ecac79c42ec3c06402e63a7107a2db628d31aff
parent 41f1de8b78ee662661ea9e63b4f0e9919ce4bd22
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Sun, 1 Feb 2026 21:32:31 +0100
try to fix s3 cache
Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>
Diffstat:
1 file changed, 138 insertions(+), 80 deletions(-)
diff --git a/apps/talos_cluster/peertube/nginx/peertube.conf b/apps/talos_cluster/peertube/nginx/peertube.conf
@@ -65,13 +65,29 @@ server {
location ~ ^/api/v1/videos/(upload-resumable|([^/]+/source/replace-resumable))$ {
client_max_body_size 0;
proxy_request_buffering off;
- try_files /dev/null @api;
+
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ proxy_set_header Host $host;
+ proxy_set_header X-Real-IP $remote_addr;
+ proxy_connect_timeout 10m;
+ proxy_send_timeout 10m;
+ proxy_read_timeout 10m;
+ send_timeout 10m;
+ proxy_pass http://peertube_backend;
}
location ~ ^/api/v1/users/[^/]+/imports/import-resumable$ {
client_max_body_size 0;
proxy_request_buffering off;
- try_files /dev/null @api;
+
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ proxy_set_header Host $host;
+ proxy_set_header X-Real-IP $remote_addr;
+ proxy_connect_timeout 10m;
+ proxy_send_timeout 10m;
+ proxy_read_timeout 10m;
+ send_timeout 10m;
+ proxy_pass http://peertube_backend;
}
# Video uploads
@@ -80,66 +96,109 @@ server {
client_max_body_size 12G;
add_header X-File-Maximum-Size 8G always;
proxy_request_buffering off;
- try_files /dev/null @api;
+
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ proxy_set_header Host $host;
+ proxy_set_header X-Real-IP $remote_addr;
+ proxy_connect_timeout 10m;
+ proxy_send_timeout 10m;
+ proxy_read_timeout 10m;
+ send_timeout 10m;
+ proxy_pass http://peertube_backend;
}
# Runner job updates
location ~ ^/api/v1/runners/jobs/[^/]+/(update|success)$ {
client_max_body_size 0;
proxy_request_buffering off;
- try_files /dev/null @api;
+
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ proxy_set_header Host $host;
+ proxy_set_header X-Real-IP $remote_addr;
+ proxy_connect_timeout 10m;
+ proxy_send_timeout 10m;
+ proxy_read_timeout 10m;
+ send_timeout 10m;
+ proxy_pass http://peertube_backend;
}
# Other media uploads
location ~ ^/api/v1/(videos|video-playlists|video-channels|users/me) {
client_max_body_size 12M;
add_header X-File-Maximum-Size 8M always;
- try_files /dev/null @api;
+
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ proxy_set_header Host $host;
+ proxy_set_header X-Real-IP $remote_addr;
+ proxy_connect_timeout 10m;
+ proxy_send_timeout 10m;
+ proxy_read_timeout 10m;
+ send_timeout 10m;
+ proxy_pass http://peertube_backend;
}
##
# WebSocket support
##
- location @api_websocket {
+ location /socket.io {
proxy_http_version 1.1;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
-
proxy_pass http://peertube_backend;
}
- location /socket.io {
- try_files /dev/null @api_websocket;
- }
-
location /tracker/socket {
+ proxy_http_version 1.1;
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ proxy_set_header Host $host;
+ proxy_set_header X-Real-IP $remote_addr;
+ proxy_set_header Upgrade $http_upgrade;
+ proxy_set_header Connection "upgrade";
proxy_read_timeout 15m;
- try_files /dev/null @api_websocket;
+ proxy_pass http://peertube_backend;
}
location ~ ^/plugins/[^/]+(/[^/]+)?/ws/ {
- try_files /dev/null @api_websocket;
+ proxy_http_version 1.1;
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ proxy_set_header Host $host;
+ proxy_set_header X-Real-IP $remote_addr;
+ proxy_set_header Upgrade $http_upgrade;
+ proxy_set_header Connection "upgrade";
+ proxy_pass http://peertube_backend;
}
##
- # S3 Cache Proxy - Named locations
+ # Static media routing to S3
##
- # Cache S3 files for a long time (filenames change when content updates)
- location @s3 {
+ # Private content goes through PeerTube for auth
+ location ~ ^(/static/(webseed|web-videos|streaming-playlists/hls)/private/)|^/download {
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ proxy_set_header Host $host;
+ proxy_set_header X-Real-IP $remote_addr;
+ proxy_limit_rate 5M;
+ proxy_pass http://peertube_backend;
+ }
+
+ # M3U8 and JSON files - no cache (for live streaming)
+ location ~ ^/static/.*\.(json|m3u8)$ {
limit_except GET OPTIONS {
deny all;
}
+ # Strip /static/ prefix for S3 path
+ rewrite ^/static/(.*)$ /$1 break;
+
resolver 1.1.1.1 8.8.8.8;
proxy_set_header Host $s3_host;
proxy_set_header Connection '';
proxy_set_header Authorization '';
- proxy_set_header Range $slice_range;
+ proxy_set_header Range $http_range;
proxy_hide_header Set-Cookie;
proxy_hide_header 'Access-Control-Allow-Origin';
proxy_hide_header 'Access-Control-Allow-Methods';
@@ -151,18 +210,12 @@ server {
proxy_hide_header x-amz-bucket-region;
proxy_hide_header x-amzn-requestid;
proxy_ignore_headers Set-Cookie;
- proxy_pass $s3_backend$s3_uri;
+ proxy_pass $s3_backend;
proxy_intercept_errors off;
- proxy_cache CACHE-S3;
- proxy_cache_valid 200 206 48h;
- proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
- slice 1m;
- proxy_cache_key $host$uri$is_args$args$slice_range;
- proxy_http_version 1.1;
+ expires 0;
+ proxy_cache off;
- expires 1y;
- add_header Cache-Control public;
add_header 'Access-Control-Allow-Origin' '*';
add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS';
add_header 'Access-Control-Allow-Headers' 'Range,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
@@ -171,12 +224,15 @@ server {
add_header Content-Security-Policy "default-src 'none'; form-action 'none'";
}
- # .ts files are live fragments - cache briefly
- location @s3-ts {
+ # .ts files for live streaming - short cache
+ location ~ ^/static/.*\.ts$ {
limit_except GET OPTIONS {
deny all;
}
+ # Strip /static/ prefix for S3 path
+ rewrite ^/static/(.*)$ /$1 break;
+
resolver 1.1.1.1 8.8.8.8;
proxy_set_header Host $s3_host;
proxy_set_header Connection '';
@@ -193,7 +249,7 @@ server {
proxy_hide_header x-amz-bucket-region;
proxy_hide_header x-amzn-requestid;
proxy_ignore_headers Set-Cookie;
- proxy_pass $s3_backend$s3_uri;
+ proxy_pass $s3_backend;
proxy_intercept_errors off;
proxy_cache CACHE-S3-TS;
@@ -213,17 +269,20 @@ server {
add_header Content-Security-Policy "default-src 'none'; form-action 'none'";
}
- # M3U8 and JSON files for live videos - don't cache
- location @s3_nocache {
+ # Map old webseed path to web-videos
+ location ~ ^/static/webseed/ {
limit_except GET OPTIONS {
deny all;
}
+ # Rewrite webseed to web-videos for S3
+ rewrite ^/static/webseed/(.*)$ /web-videos/$1 break;
+
resolver 1.1.1.1 8.8.8.8;
proxy_set_header Host $s3_host;
proxy_set_header Connection '';
proxy_set_header Authorization '';
- proxy_set_header Range $http_range;
+ proxy_set_header Range $slice_range;
proxy_hide_header Set-Cookie;
proxy_hide_header 'Access-Control-Allow-Origin';
proxy_hide_header 'Access-Control-Allow-Methods';
@@ -235,12 +294,18 @@ server {
proxy_hide_header x-amz-bucket-region;
proxy_hide_header x-amzn-requestid;
proxy_ignore_headers Set-Cookie;
- proxy_pass $s3_backend$s3_uri;
+ proxy_pass $s3_backend;
proxy_intercept_errors off;
- expires 0;
- proxy_cache off;
+ proxy_cache CACHE-S3;
+ proxy_cache_valid 200 206 48h;
+ proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
+ slice 1m;
+ proxy_cache_key $host$uri$is_args$args$slice_range;
+ proxy_http_version 1.1;
+ expires 1y;
+ add_header Cache-Control public;
add_header 'Access-Control-Allow-Origin' '*';
add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS';
add_header 'Access-Control-Allow-Headers' 'Range,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
@@ -249,55 +314,48 @@ server {
add_header Content-Security-Policy "default-src 'none'; form-action 'none'";
}
- ##
- # Static media routing to S3 cache
- ##
-
- # Private content goes through PeerTube for auth
- location ~ ^(/static/(webseed|web-videos|streaming-playlists/hls)/private/)|^/download {
- proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
- proxy_set_header Host $host;
- proxy_set_header X-Real-IP $remote_addr;
- proxy_limit_rate 5M;
- proxy_pass http://peertube_backend;
- }
-
- # M3U8 and JSON files - no cache (for live streaming)
- location ~ ^/static/.*\.(json|m3u8)$ {
- # Strip /static/ prefix for S3 path
- set $s3_uri $uri;
- if ($uri ~ ^/static/(.*)$) {
- set $s3_uri /$1;
+ # Public static content - route to S3 cache with long cache
+ location ~ ^/static/ {
+ limit_except GET OPTIONS {
+ deny all;
}
- try_files /dev/null @s3_nocache;
- }
- # .ts files for live streaming - short cache
- location ~ ^/static/.*\.ts$ {
# Strip /static/ prefix for S3 path
- set $s3_uri $uri;
- if ($uri ~ ^/static/(.*)$) {
- set $s3_uri /$1;
- }
- try_files /dev/null @s3-ts;
- }
+ rewrite ^/static/(.*)$ /$1 break;
- # Public static content - route to S3 cache with long cache
- location ~ ^/static/webseed/ {
- # Map old webseed path to web-videos
- set $s3_uri $uri;
- if ($uri ~ ^/static/webseed/(.*)$) {
- set $s3_uri /web-videos/$1;
- }
- try_files /dev/null @s3;
- }
+ resolver 1.1.1.1 8.8.8.8;
+ proxy_set_header Host $s3_host;
+ proxy_set_header Connection '';
+ proxy_set_header Authorization '';
+ proxy_set_header Range $slice_range;
+ proxy_hide_header Set-Cookie;
+ proxy_hide_header 'Access-Control-Allow-Origin';
+ proxy_hide_header 'Access-Control-Allow-Methods';
+ proxy_hide_header 'Access-Control-Allow-Headers';
+ proxy_hide_header x-amz-id-2;
+ proxy_hide_header x-amz-request-id;
+ proxy_hide_header x-amz-meta-server-side-encryption;
+ proxy_hide_header x-amz-server-side-encryption;
+ proxy_hide_header x-amz-bucket-region;
+ proxy_hide_header x-amzn-requestid;
+ proxy_ignore_headers Set-Cookie;
+ proxy_pass $s3_backend;
+ proxy_intercept_errors off;
- location ~ ^/static/ {
- # Strip /static/ prefix for S3 path
- set $s3_uri $uri;
- if ($uri ~ ^/static/(.*)$) {
- set $s3_uri /$1;
- }
- try_files /dev/null @s3;
+ proxy_cache CACHE-S3;
+ proxy_cache_valid 200 206 48h;
+ proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
+ slice 1m;
+ proxy_cache_key $host$uri$is_args$args$slice_range;
+ proxy_http_version 1.1;
+
+ expires 1y;
+ add_header Cache-Control public;
+ add_header 'Access-Control-Allow-Origin' '*';
+ add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS';
+ add_header 'Access-Control-Allow-Headers' 'Range,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
+ add_header X-Cache-Status $upstream_cache_status;
+ add_header X-Content-Type-Options nosniff;
+ add_header Content-Security-Policy "default-src 'none'; form-action 'none'";
}
}
