commit 5b9308050eca85090c29f83dcd65a1cbfe4a5ca4
parent 10c2c5bc47a623c697705eeee498de56dba5bb8b
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Sat, 29 Nov 2025 14:35:24 +0100
hopefully fix css/js
Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>
Diffstat:
6 files changed, 185 insertions(+), 10 deletions(-)
diff --git a/apps/talos_cluster/bookwyrm/deployment.yaml b/apps/talos_cluster/bookwyrm/deployment.yaml
@@ -41,6 +41,9 @@ spec:
- name: bookwyrm-data
persistentVolumeClaim:
claimName: bookwyrm-pvc
+ - name: nginx-config
+ configMap:
+ name: nginx
initContainers:
- name: bookwyrm-update
image: ghcr.io/mtrnord/bookwyrm:v0.8.2
@@ -158,15 +161,49 @@ spec:
- name: MEDIA_ROOT
value: "images/"
containers:
+ - name: nginx
+ image: nginx:latest
+ volumeMounts:
+ - name: bookwyrm-data
+ mountPath: /app/static
+ subPath: static
+ - name: bookwyrm-data
+ mountPath: /app/media
+ subPath: media
+ - name: bookwyrm-data
+ mountPath: /app/exports
+ subPath: exports
+ - name: nginx-config
+ mountPath: /etc/nginx/templates/default.conf.template
+ subPath: reverse_proxy.conf
+ readOnly: true
+ - name: nginx-config
+ mountPath: /etc/nginx/templates/server_config.template
+ subPath: server_config
+ readOnly: true
+ - name: nginx-config
+ mountPath: /etc/nginx/conf.d/locations
+ subPath: locations
+ readOnly: true
+ - name: nginx-config
+ mountPath: /etc/nginx/conf.d/server_name
+ subPath: server_name
+ readOnly: true
+ livenessProbe:
+ httpGet:
+ port: 8080
+ path: "/"
+ initialDelaySeconds: 15
+ periodSeconds: 30
+ ports:
+ - name: bookwyrm-nginx
+ containerPort: 8080
+ protocol: TCP
- name: bookwyrm-web
image: ghcr.io/mtrnord/bookwyrm:v0.8.2
imagePullPolicy: Always
command: ["gunicorn"]
args:
- #- "manage.py"
- #- "runserver"
- #- "0.0.0.0:8000"
- #- "gunicorn"
- "bookwyrm.wsgi:application"
resources:
requests:
@@ -665,8 +702,8 @@ spec:
ports:
- name: http
protocol: TCP
- port: 8000
- targetPort: 8000
+ port: 8080
+ targetPort: 8080
---
# HTTPRoute for BookWyrm
apiVersion: gateway.networking.k8s.io/v1
@@ -688,7 +725,7 @@ spec:
value: /
backendRefs:
- name: bookwyrm
- port: 8000
+ port: 8080
timeouts:
request: 240s
backendRequest: 0s
diff --git a/apps/talos_cluster/bookwyrm/kustomization.yaml b/apps/talos_cluster/bookwyrm/kustomization.yaml
@@ -9,7 +9,17 @@ configMapGenerator:
- name: bookwyrm-script
namespace: mailserver
files:
- - bookwyrm.sh=bookwyrm.sh
+ - bookwyrm.sh=bookwyrm.sh
options:
- labels:
- app: bookwyrm
+ labels:
+ app: bookwyrm
+ - name: nginx
+ namespace: bookwyrm
+ files:
+ - locations=nginx/locations
+ - reverse_proxy.conf=nginx/reverse_proxy.conf
+ - server_config=nginx/server_config
+ - server_name=nginx/server_name
+ options:
+ labels:
+ app: bookwyrm
diff --git a/apps/talos_cluster/bookwyrm/nginx/locations b/apps/talos_cluster/bookwyrm/nginx/locations
@@ -0,0 +1,52 @@
+
+
+# tell the web container the address of the outside client
+proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+# We tell that client should be behind https regardless if nginx is in reverse-proxy mode or https
+# mode
+proxy_set_header X-Forwarded-Proto https;
+proxy_set_header Host $host;
+proxy_redirect off;
+
+location ~ ^/(login[^-/]|password-reset|resend-link|2fa-check) {
+ limit_req zone=loginlimit;
+ proxy_pass http://web;
+}
+
+# do not log periodic polling requests from logged in users
+location /api/updates/ {
+ access_log off;
+ proxy_pass http://web;
+}
+
+location / {
+ proxy_pass http://web;
+}
+
+# directly serve static files from the
+# bookwyrm filesystem using sendfile.
+# make the logs quieter by not reporting these requests
+location /static/ {
+ root /app;
+ try_files $uri =404;
+ add_header X-Cache-Status STATIC;
+ access_log off;
+}
+
+# same with image files not in static folder
+location /images/ {
+ location ~ \.(bmp|ico|jpg|jpeg|png|svg|tif|tiff|webp)$ {
+ root /app;
+ try_files $uri =404;
+ add_header X-Cache-Status STATIC;
+ access_log off;
+ }
+ # block access to any non-image files from images
+ return 403;
+}
+
+# monitor the celery queues with flower, no caching enabled
+location /flower/ {
+ proxy_pass http://flower;
+ proxy_cache_bypass 1;
+}
diff --git a/apps/talos_cluster/bookwyrm/nginx/reverse_proxy.conf b/apps/talos_cluster/bookwyrm/nginx/reverse_proxy.conf
@@ -0,0 +1,49 @@
+include /etc/nginx/conf.d/server_config;
+
+upstream web {
+ server web:8000;
+}
+upstream flower {
+ server flower:5555;
+}
+
+server {
+ access_log /var/log/nginx/access.log cache_log;
+
+ listen 8080;
+ include /etc/nginx/conf.d/server_name;
+
+ http2 on;
+
+ sendfile on;
+ tcp_nopush on;
+ tcp_nodelay on;
+ keepalive_timeout 65;
+ types_hash_max_size 2048;
+ #include /etc/nginx/mime.types;
+ #default_type application/octet-stream;
+
+ gzip on;
+ gzip_disable "msie6";
+
+ proxy_read_timeout 1800s;
+ chunked_transfer_encoding on;
+
+ # store responses to anonymous users for up to 1 minute
+ proxy_cache bookwyrm_cache;
+ proxy_cache_valid any 1m;
+ add_header X-Cache-Status $upstream_cache_status;
+
+ # ignore the set cookie header when deciding to
+ # store a response in the cache
+ proxy_ignore_headers Cache-Control Set-Cookie Expires;
+
+ # PUT requests always bypass the cache
+ # logged in sessions also do not populate the cache
+ # to avoid serving personal data to anonymous users
+ proxy_cache_methods GET HEAD;
+ proxy_no_cache $cookie_sessionid;
+ proxy_cache_bypass $cookie_sessionid;
+
+ include /etc/nginx/conf.d/locations;
+}
diff --git a/apps/talos_cluster/bookwyrm/nginx/server_config b/apps/talos_cluster/bookwyrm/nginx/server_config
@@ -0,0 +1,26 @@
+client_max_body_size ${MAX_UPLOAD_MiB}m;
+limit_req_zone $binary_remote_addr zone=loginlimit:10m rate=1r/s;
+
+# include the cache status in the log message
+log_format cache_log '$upstream_cache_status - '
+ '$remote_addr [$time_local] '
+ '"$request" $status $body_bytes_sent '
+ '"$http_referer" "$http_user_agent" '
+ '$upstream_response_time $request_time';
+
+# Create a cache for responses from the web app
+proxy_cache_path
+ /var/cache/nginx/bookwyrm_cache
+ keys_zone=bookwyrm_cache:20m
+ loader_threshold=400
+ loader_files=400
+ max_size=400m;
+
+# use the accept header as part of the cache key
+# since activitypub endpoints have both HTML and JSON
+# on the same URI.
+proxy_cache_key $scheme$proxy_host$uri$is_args$args$http_accept;
+# only let one request to populate cache, see https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_cache_lock
+proxy_cache_lock on;
+proxy_cache_lock_age 10s;
+proxy_cache_lock_timeout 10s;
diff --git a/apps/talos_cluster/bookwyrm/nginx/server_name b/apps/talos_cluster/bookwyrm/nginx/server_name
@@ -0,0 +1 @@
+server_name ${DOMAIN};
