kami/Maven
1
0
Fork 0
Code Issues 1 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

deploy: stop mavweb becoming the default nginx server by file order

Browse Source 
The maven block was first in nginx.conf, and nginx serves the first block for
a listen address when no server_name matches. Those two ports used to default
to nexus. After the maven block landed, a request with an unknown or absent
Host header reached mavweb instead, which is the one surface in the file that
can define and run argv. The ACL still held, so this was not an exposure, but
it is the wrong default to acquire by accident.

The nexus block is now marked default_server so the choice is explicit, and
the maven block moved last as a second guard. Also raises client_body_timeout
and proxy_send_timeout to match client_max_body_size 32m, since a slow
push-to-talk upload was cut at the 60s default on both while
proxy_read_timeout was already 300s.

Found in review of #52.
This commit is contained in:
kami
2026-08-01 13:56:44 +04:00
parent 49dfeb879e
commit 0e83ddf3df
1 changed files with 59 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/ecosystem/nginx.conf
+59 -40
View File
@@ -31,49 +31,24 @@
# read the note at the top of that file first.
#
# `nginx -t` catches the second and not the first. Run it anyway, every time.
# maven.<domain> → mavweb (docker-compose.yml publishes it on 127.0.0.1:9201).
# Same bind + ACL as the siblings, and for a stronger reason: mavweb serves
# POST /tools, which defines argv that internal/tool EXECUTES, plus POST
# /routines, /api/revert and /api/chat (Vikunja #317). Without
# -webauthn-origin/-webauthn-rpid mavweb has no auth of its own, so this block
# is the auth. If you add TLS and a basic-auth/oauth2-proxy layer, keep the
# allow/deny anyway — belt and braces on an RCE surface.
#
# WebSocket upgrade matters here: /ws carries push-to-talk audio, so the
# Upgrade/Connection headers below are required, not decoration. They reference
# $connection_upgrade, which this file does NOT define — see
# nginx-upgrade-map.conf and point 2 above.
# BLOCK ORDER IS LOAD-BEARING. nginx serves the first block for a given listen
# address when no server_name matches, so whichever block comes first here
# answers requests with an unknown or absent Host header. That must not be
# mavweb: it is the one surface in this file that can define and run argv. The
# nexus block is marked default_server so the choice is explicit rather than a
# consequence of file order, and the maven block sits last as a second guard.
# If you add a block, do not put it above nexus. If another site file already
# claims default_server on 10.42.0.1:80 or 192.168.1.104:80, nginx refuses to
# start with "a duplicate default server" — drop the two keywords here and rely
# on the block order instead.
#
# Every server_name below is a literal for kvmx.ru even though the comments
# write maven.<domain>. This file reads like a template and is not one.
server {
listen 10.42.0.1:80;
listen 192.168.1.104:80;
server_name maven.kvmx.ru;
allow 10.42.0.0/24;
allow 192.168.1.0/24;
deny all;
# push-to-talk uploads raw PCM; the default 1m is enough for a short
# utterance but not for a long one.
client_max_body_size 32m;
location / {
proxy_pass http://127.0.0.1:9201;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 300s; # an LLM turn can take minutes on the iGPU
}
}
server {
listen 10.42.0.1:80;
listen 192.168.1.104:80;
listen 10.42.0.1:80 default_server;
listen 192.168.1.104:80 default_server;
server_name nexus.kvmx.ru;
allow 10.42.0.0/24;
@@ -124,3 +99,47 @@ server {
proxy_set_header X-Forwarded-Proto $scheme;
}
}
# maven.<domain> → mavweb (docker-compose.yml publishes it on 127.0.0.1:9201).
# Same bind + ACL as the siblings, and for a stronger reason: mavweb serves
# POST /tools, which defines argv that internal/tool EXECUTES, plus POST
# /routines, /api/revert, /api/chat, /api/ptt and /ws (Vikunja #317). Without
# -webauthn-origin/-webauthn-rpid mavweb has no auth of its own, so this block
# is the auth. If you add TLS and a basic-auth/oauth2-proxy layer, keep the
# allow/deny anyway — belt and braces on an RCE surface.
#
# WebSocket upgrade matters here: /ws carries push-to-talk audio, so the
# Upgrade/Connection headers below are required, not decoration. They reference
# $connection_upgrade, which this file does NOT define — see
# nginx-upgrade-map.conf and point 2 above.
server {
listen 10.42.0.1:80;
listen 192.168.1.104:80;
server_name maven.kvmx.ru;
allow 10.42.0.0/24;
allow 192.168.1.0/24;
deny all;
# push-to-talk uploads raw PCM; the default 1m is enough for a short
# utterance but not for a long one.
client_max_body_size 32m;
# A 32m upload over a slow link outlives the 60s default on the two body
# timeouts, and nginx cuts it at exactly 60s with a 408 or a 504 that looks
# like the turn failed. Raise them with the size, not just proxy_read_timeout.
client_body_timeout 300s;
location / {
proxy_pass http://127.0.0.1:9201;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_send_timeout 300s; # pushing the PCM upstream, same reason
proxy_read_timeout 300s; # an LLM turn can take minutes on the iGPU
}
}