27 lines
1.0 KiB
Django/Jinja
Executable File
27 lines
1.0 KiB
Django/Jinja
Executable File
{% if www_membership_enabled %}
|
|
ProxyRequests Off
|
|
ProxyPreserveHost On
|
|
ProxyPass "/members/" "http://membership:8000/members/" connectiontimeout=5 timeout=120
|
|
ProxyPassReverse "/members/" "http://membership:8000/members/"
|
|
<Location "/members/">
|
|
# NetworkPolicy permits only Apache to assert these headers.
|
|
RequestHeader set X-Forwarded-Proto "https"
|
|
RequestHeader set X-Membership-Client-IP "expr=%{REMOTE_ADDR}"
|
|
LimitRequestBody 262144
|
|
# The Tor/public static mirror remains available, but account/billing flows
|
|
# use only the canonical HTTPS origin registered in Dex and Stripe.
|
|
<If "%{HTTP_HOST} != '{{ www_hostname }}'">
|
|
Require all denied
|
|
</If>
|
|
</Location>
|
|
<Location "/members/profile/">
|
|
# Bounded JPEG upload plus multipart overhead; other routes remain 256 KiB.
|
|
LimitRequestBody 2097152
|
|
</Location>
|
|
{% else %}
|
|
# Membership proxy disabled. Existing stateful workloads are not deleted.
|
|
<Location "/members/">
|
|
Require all denied
|
|
</Location>
|
|
{% endif %}
|