fix and update

2026-06-29 17:00:12 +03:00
parent 6a7f1c5edf
commit 3fd5509186
1 changed files with 89 additions and 34 deletions
--- a/install.sh
+++ b/install.sh
@@ -1673,6 +1673,58 @@ nginx_proxy_headers="        proxy_set_header Host \$host;
        proxy_read_timeout 300s;
        proxy_connect_timeout 75s;"

+# Встроенный DNS Docker. В docker-режиме nginx обязан перерезолвлять имена
+# бэкенд-контейнеров на каждый запрос — иначе после пересборки контейнера
+# (новый IP) остаётся закешированный старый адрес и все ответы становятся 502.
+NGINX_DOCKER_RESOLVER="        resolver 127.0.0.11 ipv6=off valid=10s;"
+
+# Имя nginx-переменной из ключа апстрима (только [A-Za-z0-9_]).
+nginx_upstream_var() {
+  printf 'idp_up_%s' "$(printf '%s' "$1" | tr -c 'A-Za-z0-9' '_')"
+}
+
+# proxy_pass к КОРНЮ апстрима ($request_uri сохраняет путь и query).
+# docker: через resolver+переменную (переживает смену IP контейнера).
+# host:   статический proxy_pass на 127.0.0.1 (DNS-кеша нет, IP не меняется).
+render_proxy_root() {
+  local key="$1" up var
+  up="$(nginx_upstream "$key")"
+  if [[ "$NGINX_MODE" == "docker" ]]; then
+    var="$(nginx_upstream_var "$key")"
+    printf '%s\n        set $%s %s;\n        proxy_pass $%s$request_uri;' \
+      "$NGINX_DOCKER_RESOLVER" "$var" "$up" "$var"
+  else
+    printf '        proxy_pass %s;' "$up"
+  fi
+}
+
+# proxy_pass с заменой пути на фиксированный ($2, например /ws или /oauth/).
+# Используется там, где префикс локейшна нужно «срезать»/заменить.
+render_proxy_rewrite() {
+  local key="$1" target="$2" up var
+  up="$(nginx_upstream "$key")"
+  if [[ "$NGINX_MODE" == "docker" ]]; then
+    var="$(nginx_upstream_var "$key")"
+    printf '%s\n        set $%s %s;\n        rewrite ^.*$ %s break;\n        proxy_pass $%s;' \
+      "$NGINX_DOCKER_RESOLVER" "$var" "$up" "$target" "$var"
+  else
+    printf '        proxy_pass %s%s;' "$up" "$target"
+  fi
+}
+
+# proxy_pass для /idp-api/ — срезает префикс /idp-api/ и проксирует на корень.
+render_proxy_idp_api() {
+  local key="api" up var
+  up="$(nginx_upstream "$key")"
+  if [[ "$NGINX_MODE" == "docker" ]]; then
+    var="$(nginx_upstream_var "$key")"
+    printf '%s\n        set $%s %s;\n        rewrite ^/idp-api/(.*)$ /$1 break;\n        proxy_pass $%s;' \
+      "$NGINX_DOCKER_RESOLVER" "$var" "$up" "$var"
+  else
+    printf '        proxy_pass %s/;' "$up"
+  fi
+}
+
 nginx_write_conf() {
  local conf="$1"
  if [[ "$NGINX_MODE" == "docker" ]]; then
@@ -1743,11 +1795,11 @@ EOF
 build_ws_block() {
  local ws_on_api="$1"
  [[ "$ws_on_api" != "true" ]] && return 0
-  local upstream
-  upstream="$(nginx_upstream ws)"
+  local proxy_ws
+  proxy_ws="$(render_proxy_rewrite ws /ws)"
  cat <<EOF
    location /ws {
-        proxy_pass ${upstream}/ws;
+${proxy_ws}
        proxy_http_version 1.1;
        proxy_set_header Upgrade \$http_upgrade;
        proxy_set_header Connection "upgrade";
@@ -1767,8 +1819,8 @@ EOF
 # и проставляет CORS-заголовки, отражая Origin (нужно для credentials: cookie/JWT).
 # Заголовки CORS от upstream скрываем, чтобы не было дублей Access-Control-Allow-Origin.
 build_nginx_api_location_block() {
-  local upstream
-  upstream="$(nginx_upstream api)"
+  local proxy_api
+  proxy_api="$(render_proxy_root api)"
  cat <<EOF
    location / {
        set \$cors_origin "";
@@ -1789,7 +1841,7 @@ build_nginx_api_location_block() {
        add_header Access-Control-Allow-Origin \$cors_origin always;
        add_header Access-Control-Allow-Credentials true always;

-        proxy_pass ${upstream};
+${proxy_api}
        proxy_http_version 1.1;
 ${nginx_proxy_headers}
    }
@@ -1835,12 +1887,15 @@ EOF
 }

 build_nginx_idp_api_proxy_block() {
-  local api_upstream ws_upstream
-  api_upstream="$(nginx_upstream api)"
-  ws_upstream="$(nginx_upstream ws)"
+  local proxy_ws proxy_idp proxy_oauth proxy_wk proxy_fedcm
+  proxy_ws="$(render_proxy_rewrite ws /ws)"
+  proxy_idp="$(render_proxy_idp_api)"
+  proxy_oauth="$(render_proxy_root api)"
+  proxy_wk="$(render_proxy_root api)"
+  proxy_fedcm="$(render_proxy_root api)"
  cat <<EOF
    location /idp-api/ws {
-        proxy_pass ${ws_upstream}/ws;
+${proxy_ws}
        proxy_http_version 1.1;
        proxy_set_header Upgrade \$http_upgrade;
        proxy_set_header Connection "upgrade";
@@ -1852,25 +1907,25 @@ build_nginx_idp_api_proxy_block() {
    }

    location /idp-api/ {
-        proxy_pass ${api_upstream}/;
+${proxy_idp}
        proxy_http_version 1.1;
 ${nginx_proxy_headers}
    }

    location /oauth/ {
-        proxy_pass ${api_upstream}/oauth/;
+${proxy_oauth}
        proxy_http_version 1.1;
 ${nginx_proxy_headers}
    }

    location /.well-known/ {
-        proxy_pass ${api_upstream}/.well-known/;
+${proxy_wk}
        proxy_http_version 1.1;
 ${nginx_proxy_headers}
    }

    location /fedcm/ {
-        proxy_pass ${api_upstream}/fedcm/;
+${proxy_fedcm}
        proxy_http_version 1.1;
 ${nginx_proxy_headers}
    }
@@ -1881,9 +1936,9 @@ EOF
 write_nginx_site_frontend() {
  local domain="$1"
  local ssl_type="${2:-none}"
-  local conf upstream http_preamble ssl_block idp_api_block
+  local conf http_preamble ssl_block idp_api_block proxy_root
  conf="$(nginx_conf_target frontend)"
-  upstream="$(nginx_upstream frontend)"
+  proxy_root="$(render_proxy_root frontend)"
  http_preamble="$(nginx_http_server_preamble "$domain" "$ssl_type")"
  idp_api_block="$(build_nginx_idp_api_proxy_block)"

@@ -1895,7 +1950,7 @@ server {
    server_name ${domain};
 ${idp_api_block}
    location / {
-        proxy_pass ${upstream};
+${proxy_root}
        proxy_http_version 1.1;
 ${nginx_proxy_headers}
    }
@@ -1912,7 +1967,7 @@ ${ssl_block}
    client_max_body_size 50m;
 ${idp_api_block}
    location / {
-        proxy_pass ${upstream};
+${proxy_root}
        proxy_http_version 1.1;
 ${nginx_proxy_headers}
    }
@@ -1930,9 +1985,9 @@ EOF
 write_nginx_site_fedcm_apex() {
  local domain="$1"
  local ssl_type="${2:-none}"
-  local conf upstream http_preamble ssl_block idp_api_block
+  local conf http_preamble ssl_block idp_api_block proxy_root
  conf="$(nginx_conf_target fedcm-apex)"
-  upstream="$(nginx_upstream frontend)"
+  proxy_root="$(render_proxy_root frontend)"
  http_preamble="$(nginx_http_server_preamble "$domain" "$ssl_type")"
  idp_api_block="$(build_nginx_idp_api_proxy_block)"

@@ -1945,7 +2000,7 @@ server {
    client_max_body_size 50m;
 ${idp_api_block}
    location / {
-        proxy_pass ${upstream};
+${proxy_root}
        proxy_http_version 1.1;
 ${nginx_proxy_headers}
    }
@@ -1962,7 +2017,7 @@ ${ssl_block}
    client_max_body_size 50m;
 ${idp_api_block}
    location / {
-        proxy_pass ${upstream};
+${proxy_root}
        proxy_http_version 1.1;
 ${nginx_proxy_headers}
    }
@@ -1975,9 +2030,9 @@ EOF
 write_nginx_site_docs() {
  local domain="$1"
  local ssl_type="${2:-none}"
-  local conf upstream http_preamble ssl_block
+  local conf http_preamble ssl_block proxy_root
  conf="$(nginx_conf_target docs)"
-  upstream="$(nginx_upstream docs)"
+  proxy_root="$(render_proxy_root docs)"
  http_preamble="$(nginx_http_server_preamble "$domain" "$ssl_type")"

  if [[ "$ssl_type" == "none" ]]; then
@@ -1988,7 +2043,7 @@ server {
    server_name ${domain};
    location = / { return 302 /docs; }
    location / {
-        proxy_pass ${upstream};
+${proxy_root}
        proxy_http_version 1.1;
 ${nginx_proxy_headers}
    }
@@ -2004,7 +2059,7 @@ ${http_preamble}server {
 ${ssl_block}
    location = / { return 302 /docs; }
    location / {
-        proxy_pass ${upstream};
+${proxy_root}
        proxy_http_version 1.1;
 ${nginx_proxy_headers}
    }
@@ -2017,9 +2072,9 @@ EOF
 write_nginx_site_ws() {
  local domain="$1"
  local ssl_type="${2:-none}"
-  local conf upstream http_preamble ssl_block
+  local conf http_preamble ssl_block proxy_ws
  conf="$(nginx_conf_target ws)"
-  upstream="$(nginx_upstream ws)"
+  proxy_ws="$(render_proxy_rewrite ws /ws)"
  http_preamble="$(nginx_http_server_preamble "$domain" "$ssl_type")"

  if [[ "$ssl_type" == "none" ]]; then
@@ -2029,7 +2084,7 @@ server {
    listen [::]:80;
    server_name ${domain};
    location / {
-        proxy_pass ${upstream}/ws;
+${proxy_ws}
        proxy_http_version 1.1;
        proxy_set_header Upgrade \$http_upgrade;
        proxy_set_header Connection "upgrade";
@@ -2050,7 +2105,7 @@ ${http_preamble}server {
    server_name ${domain};
 ${ssl_block}
    location / {
-        proxy_pass ${upstream}/ws;
+${proxy_ws}
        proxy_http_version 1.1;
        proxy_set_header Upgrade \$http_upgrade;
        proxy_set_header Connection "upgrade";
@@ -2071,9 +2126,9 @@ write_nginx_site_minio() {
  local kind="$2"
  local label="$3"
  local ssl_type="${4:-none}"
-  local conf upstream http_preamble ssl_block
+  local conf http_preamble ssl_block proxy_root
  conf="$(nginx_conf_target "$label")"
-  upstream="$(nginx_upstream "$kind")"
+  proxy_root="$(render_proxy_root "$kind")"
  http_preamble="$(nginx_http_server_preamble "$domain" "$ssl_type")"

  if [[ "$ssl_type" == "none" ]]; then
@@ -2085,7 +2140,7 @@ server {
    client_max_body_size 1024m;
    proxy_buffering off;
    location / {
-        proxy_pass ${upstream};
+${proxy_root}
        proxy_http_version 1.1;
 ${nginx_proxy_headers}
    }
@@ -2102,7 +2157,7 @@ ${ssl_block}
    client_max_body_size 1024m;
    proxy_buffering off;
    location / {
-        proxy_pass ${upstream};
+${proxy_root}
        proxy_http_version 1.1;
 ${nginx_proxy_headers}
    }