AI overhaul

2026-10-23 12:49:53 -04:00
parent b040ca26c3
commit b4db1a0182
21 changed files with 1226 additions and 189 deletions
@@ -0,0 +1,22 @@
+{% if www_membership_enabled %}
+ProxyRequests Off
+ProxyPreserveHost On
+ProxyPass "/members/" "http://membership:8000/members/" connectiontimeout=5 timeout=120
+ProxyPassReverse "/members/" "http://membership:8000/members/"
+<Location "/members/">
+    # NetworkPolicy permits only Apache to assert these headers.
+    RequestHeader set X-Forwarded-Proto "https"
+    RequestHeader set X-Membership-Client-IP "expr=%{REMOTE_ADDR}"
+    LimitRequestBody 262144
+    # The Tor/public static mirror remains available, but account/billing flows
+    # use only the canonical HTTPS origin registered in Dex and Stripe.
+    <If "%{HTTP_HOST} != '{{ www_hostname }}'">
+        Require all denied
+    </If>
+</Location>
+{% else %}
+# Membership proxy disabled. Existing stateful workloads are not deleted.
+<Location "/members/">
+    Require all denied
+</Location>
+{% endif %}