From 3bc9f2d3030fac8d5e61ab499bd35ace1149a62c Mon Sep 17 00:00:00 2001
From: kami <kami@homesrv>
Date: Tue, 14 Jul 2026 15:51:10 +0400
Subject: [PATCH] muzick: nginx proxy Bearer auth, restart policies, env subst

---
 docker-compose.yml           | 11 ++++++++---
 frontend/Dockerfile          |  4 ++--
 frontend/nginx.conf.template | 19 +++++++++++++++++++
 3 files changed, 29 insertions(+), 5 deletions(-)
 create mode 100644 frontend/nginx.conf.template

diff --git a/docker-compose.yml b/docker-compose.yml
index f37fc52..a608a2c 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -16,15 +16,16 @@ services:
     image: typesense/typesense:0.25.1
     restart: always
     ports:
-      - "8108:8108"
+      - "127.0.0.1:8108:8108"
     volumes:
       - ./data/typesense:/data
     command: --data-dir /data --api-key=${TYPESENSE_API_KEY}
 
   backend:
     build: ./backend
+    restart: unless-stopped
     ports:
-      - "3000:3000"
+      - "127.0.0.1:3000:3000"
     environment:
       DATABASE_URL: postgresql://user:${DB_PASSWORD}@db:5432/muzick
       REDIS_URL: redis://:${REDIS_PASSWORD}@infra-redis:6379
@@ -43,13 +44,17 @@ services:
 
   frontend:
     build: ./frontend
+    restart: unless-stopped
     ports:
-      - "5174:80"
+      - "127.0.0.1:5174:80"
+    environment:
+      MUZICK_API_KEY: ${MUZICK_API_KEY}
     depends_on:
       - backend
 
   worker:
     build: ./workers
+    restart: unless-stopped
     network_mode: host
     environment:
       DATABASE_URL: postgresql://user:${DB_PASSWORD}@127.0.0.1:5432/muzick
diff --git a/frontend/Dockerfile b/frontend/Dockerfile
index 54abf9e..21d6d64 100644
--- a/frontend/Dockerfile
+++ b/frontend/Dockerfile
@@ -7,6 +7,6 @@ RUN npm run build
 
 FROM nginx:stable-alpine
 COPY --from=build /app/dist /usr/share/nginx/html
-COPY nginx.conf /etc/nginx/conf.d/default.conf
+COPY nginx.conf.template /etc/nginx/templates/default.conf.template
 EXPOSE 80
-CMD ["nginx", "-g", "daemon off;"]
+CMD ["/bin/sh", "-c", "envsubst '${MUZICK_API_KEY}' < /etc/nginx/templates/default.conf.template > /etc/nginx/conf.d/default.conf && nginx -g 'daemon off;'"]
diff --git a/frontend/nginx.conf.template b/frontend/nginx.conf.template
new file mode 100644
index 0000000..c39db7a
--- /dev/null
+++ b/frontend/nginx.conf.template
@@ -0,0 +1,19 @@
+server {
+    listen 80;
+
+    location / {
+        root /usr/share/nginx/html;
+        index index.html index.htm;
+        try_files $uri $uri/ /index.html;
+    }
+
+    location /api {
+        proxy_pass http://backend:3000;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection 'upgrade';
+        proxy_set_header Host $host;
+        proxy_set_header Authorization "Bearer ${MUZICK_API_KEY}";
+        proxy_cache_bypass $http_upgrade;
+    }
+}