ClaudeandClaude Opus 5.5
d694ae5650
Service sign-up buttons link to /members, which 404'd because only /members/ is proxied. Use an absolute https target since TLS ends at the ingress. Add an opt-in task that creates any missing tier/service group from the role's config (with the placeholder member) in the OpenLDAP pod, leaving existing groups untouched. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
30 lines
1.2 KiB
Django/Jinja
Executable File
30 lines
1.2 KiB
Django/Jinja
Executable File
{% if www_membership_enabled %}
|
|
ProxyRequests Off
|
|
ProxyPreserveHost On
|
|
# Service sign-up buttons link to /members; the app lives under /members/.
|
|
# Absolute target: TLS ends at ingress, so a relative one becomes http://...:443
|
|
RedirectMatch 301 "^/members$" "https://{{ www_hostname }}/members/"
|
|
ProxyPass "/members/" "http://membership:8000/members/" connectiontimeout=5 timeout=120
|
|
ProxyPassReverse "/members/" "http://membership:8000/members/"
|
|
<Location "/members/">
|
|
# NetworkPolicy permits only Apache to assert these headers.
|
|
RequestHeader set X-Forwarded-Proto "https"
|
|
RequestHeader set X-Membership-Client-IP "expr=%{REMOTE_ADDR}"
|
|
LimitRequestBody 262144
|
|
# The Tor/public static mirror remains available, but account/billing flows
|
|
# use only the canonical HTTPS origin registered in Dex and Stripe.
|
|
<If "%{HTTP_HOST} != '{{ www_hostname }}'">
|
|
Require all denied
|
|
</If>
|
|
</Location>
|
|
<Location "/members/profile/">
|
|
# Bounded JPEG upload plus multipart overhead; other routes remain 256 KiB.
|
|
LimitRequestBody 2097152
|
|
</Location>
|
|
{% else %}
|
|
# Membership proxy disabled. Existing stateful workloads are not deleted.
|
|
<Location "/members/">
|
|
Require all denied
|
|
</Location>
|
|
{% endif %}
|