kami/Maven
1
0
Fork 0
Code Issues 1 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Add a locked-down maven.<domain> block to the nginx template (#354) #52

Closed
claude wants to merge 1 commits from overnight/nginx-maven-block into overnight/stepup-chat-surface
pull from: overnight/nginx-maven-block
merge into: kami:overnight/stepup-chat-surface
Conversation 3 Commits 1 Files Changed 2
+60 -3
claude commented 2026-07-31 23:27:25 +02:00
Contributor
Copy Link
Copy Source

What

  • deploy/ecosystem/nginx.conf gains a maven.kvmx.ru server: listen 10.42.0.1:80 + listen 192.168.1.104:80, allow wg/LAN + deny all, proxying 127.0.0.1:9201 (where docker-compose.yml publishes mavweb). Includes the WebSocket upgrade /ws needs (via a $connection_upgrade map), client_max_body_size 32m for push-to-talk PCM, and proxy_read_timeout 300s because an LLM turn on the iGPU is slow.
  • deploy/ecosystem/docker-compose.yml header now states that the sibling build: paths pin nothing and ship the sibling working tree, with the one-liner to check what is about to be deployed.

Why

The wildcard listen 80 with no ACL that the task reported was already fixed in 50cc17f, but the template still covered only nexus/praxis/hexis. mavweb is the service in that set with an actual RCE surface (POST /tools defines argv internal/tool executes) and had no block, so anyone fronting it wrote their own — which is how an unrestricted listen 80 appears in the first place. Also closes #317's item 5.

Not in this PR

The stale public DNS records for hexis./maven./nexus./vikunja.kvmx.ru pointing at 109.229.102.117 are outside the repo — still yours to clean up.

Verified

nginx -t accepts the template wrapped in a minimal http{} (only the pid-file write fails, unprivileged). docker compose config -q clean. make build and make test exit 0.

Vikunja #354

## What - `deploy/ecosystem/nginx.conf` gains a `maven.kvmx.ru` server: `listen 10.42.0.1:80` + `listen 192.168.1.104:80`, `allow` wg/LAN + `deny all`, proxying `127.0.0.1:9201` (where `docker-compose.yml` publishes mavweb). Includes the WebSocket upgrade `/ws` needs (via a `$connection_upgrade` map), `client_max_body_size 32m` for push-to-talk PCM, and `proxy_read_timeout 300s` because an LLM turn on the iGPU is slow. - `deploy/ecosystem/docker-compose.yml` header now states that the sibling `build:` paths pin nothing and ship the sibling working tree, with the one-liner to check what is about to be deployed. ## Why The wildcard `listen 80` with no ACL that the task reported was already fixed in 50cc17f, but the template still covered only nexus/praxis/hexis. mavweb is the service in that set with an actual RCE surface (`POST /tools` defines argv `internal/tool` executes) and had no block, so anyone fronting it wrote their own — which is how an unrestricted `listen 80` appears in the first place. Also closes #317's item 5. ## Not in this PR The stale public DNS records for hexis./maven./nexus./vikunja.kvmx.ru pointing at 109.229.102.117 are outside the repo — still yours to clean up. ## Verified `nginx -t` accepts the template wrapped in a minimal `http{}` (only the pid-file write fails, unprivileged). `docker compose config -q` clean. `make build` and `make test` exit 0. Vikunja #354
claude added 1 commit 2026-07-31 23:27:25 +02:00
Add a locked-down maven.<domain> block to the nginx template (#354) 9190f897a3 
The template's wildcard `listen 80` with no ACL was fixed in 50cc17f, but it
still only covered nexus/praxis/hexis. mavweb — the one service in the set
that serves an RCE surface (POST /tools defines argv internal/tool executes)
— had no block at all, so anyone wiring it up wrote their own, which is how
the wildcard got there the first time.

Adds a maven.kvmx.ru server with the same wg+LAN bind and allow/deny,
proxying 127.0.0.1:9201, with the WebSocket upgrade /ws needs, a 32m body
limit for push-to-talk PCM, and a 300s read timeout because an LLM turn on
the iGPU is slow.

Also records in deploy/ecosystem/docker-compose.yml that the sibling
`build:` paths pin nothing and ship the sibling working tree, with the
command to check what is about to be deployed. The stale public DNS records
(item 2) are outside the repo.

Verified: nginx -t on the template inside a minimal http{} accepts it.
kami reviewed 2026-08-01 10:00:23 +02:00
deploy/ecosystem/nginx.conf
@@ -15,0 +26,4 @@
# `Connection: upgrade` off plain requests; it sits in the http context, which
# is where sites-available files are included — if your nginx already defines
# $connection_upgrade, drop this block.
map $http_upgrade $connection_upgrade {
kami commented 2026-08-01 10:00:23 +02:00
Owner
Copy Link
Copy Source

is this not for the docker container?
is this the reason nginx crashed today?

is this not for the docker container? is this the reason nginx crashed today?
claude reviewed 2026-08-01 11:21:28 +02:00
claude left a comment
Author
Contributor
Copy Link
Copy Source

The block is right in substance. Same bind and same ACL as the siblings. client_max_body_size 32m for PCM uploads, proxy_read_timeout 300s for a slow iGPU turn. The header says plainly that this file is the auth. The compose warning about building from sibling working trees is worth more than it looks.

The duplicate map you flagged is fixed on the tip branch at 7f42cc7, moved to deploy/ecosystem/nginx-upgrade-map.conf. This diff still shows it inline, which is expected for the stack.

One thing not yet covered.

The maven block is now first in the file, which makes it the default server. nginx picks the first block for a given listen line when no server_name matches. Those two ports previously defaulted to nexus. Now a request with an unknown or absent Host header reaches mavweb instead. That is the one surface here that can define and run argv. The ACL still holds, so this is not an exposure. It is still the wrong default to acquire by file order. Either mark one block default_server on purpose, or move the maven block below the siblings.

Two smaller ones:

  • server_name maven.kvmx.ru is a literal, while the header writes maven.<domain>. The siblings do the same, so this is consistent. Worth noting only because the file reads as a template and is not one.
  • proxy_read_timeout 300s covers the reply, but a long push-to-talk upload on a slow link is bounded by client_body_timeout and proxy_send_timeout, both at their 60s defaults. If a real upload ever times out at exactly 60s, that pair is the reason.
The block is right in substance. Same bind and same ACL as the siblings. `client_max_body_size 32m` for PCM uploads, `proxy_read_timeout 300s` for a slow iGPU turn. The header says plainly that this file is the auth. The compose warning about building from sibling working trees is worth more than it looks. The duplicate `map` you flagged is fixed on the tip branch at `7f42cc7`, moved to `deploy/ecosystem/nginx-upgrade-map.conf`. This diff still shows it inline, which is expected for the stack. One thing not yet covered. **The maven block is now first in the file, which makes it the default server.** nginx picks the first block for a given `listen` line when no `server_name` matches. Those two ports previously defaulted to nexus. Now a request with an unknown or absent Host header reaches mavweb instead. That is the one surface here that can define and run argv. The ACL still holds, so this is not an exposure. It is still the wrong default to acquire by file order. Either mark one block `default_server` on purpose, or move the maven block below the siblings. Two smaller ones: - `server_name maven.kvmx.ru` is a literal, while the header writes `maven.<domain>`. The siblings do the same, so this is consistent. Worth noting only because the file reads as a template and is not one. - `proxy_read_timeout 300s` covers the reply, but a long push-to-talk upload on a slow link is bounded by `client_body_timeout` and `proxy_send_timeout`, both at their 60s defaults. If a real upload ever times out at exactly 60s, that pair is the reason.
kami closed this pull request 2026-08-01 14:51:38 +02:00
kami commented 2026-08-01 14:52:32 +02:00
Owner
Copy Link
Copy Source

Landed on master. The stack was one linear chain, so #84 carried every commit from #50 up, and master now contains this branch in full. Merging this PR on its own is an empty diff, so it is closed rather than merged. The review findings for it were fixed in the 2026-08-01 pass and are on master as commits on the stack tip, not on this branch.

Landed on master. The stack was one linear chain, so #84 carried every commit from #50 up, and master now contains this branch in full. Merging this PR on its own is an empty diff, so it is closed rather than merged. The review findings for it were fixed in the 2026-08-01 pass and are on master as commits on the stack tip, not on this branch.

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
kami
claude
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
kami
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: kami/Maven#52
Delete Branch "overnight/nginx-maven-block"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?