From 3fd55091865cce9207636b246d15daf7e047edc2 Mon Sep 17 00:00:00 2001
From: lendry <lendry@lendry1.ru>
Date: Mon, 29 Jun 2026 17:00:12 +0300
Subject: [PATCH] fix and update

---
 install.sh | 123 ++++++++++++++++++++++++++++++++++++++---------------
 1 file changed, 89 insertions(+), 34 deletions(-)

diff --git a/install.sh b/install.sh
index 8897e7b..59b849a 100644
--- a/install.sh
+++ b/install.sh
@@ -1673,6 +1673,58 @@ nginx_proxy_headers="        proxy_set_header Host \$host;
         proxy_read_timeout 300s;
         proxy_connect_timeout 75s;"
 
+# Встроенный DNS Docker. В docker-режиме nginx обязан перерезолвлять имена
+# бэкенд-контейнеров на каждый запрос — иначе после пересборки контейнера
+# (новый IP) остаётся закешированный старый адрес и все ответы становятся 502.
+NGINX_DOCKER_RESOLVER="        resolver 127.0.0.11 ipv6=off valid=10s;"
+
+# Имя nginx-переменной из ключа апстрима (только [A-Za-z0-9_]).
+nginx_upstream_var() {
+  printf 'idp_up_%s' "$(printf '%s' "$1" | tr -c 'A-Za-z0-9' '_')"
+}
+
+# proxy_pass к КОРНЮ апстрима ($request_uri сохраняет путь и query).
+# docker: через resolver+переменную (переживает смену IP контейнера).
+# host:   статический proxy_pass на 127.0.0.1 (DNS-кеша нет, IP не меняется).
+render_proxy_root() {
+  local key="$1" up var
+  up="$(nginx_upstream "$key")"
+  if [[ "$NGINX_MODE" == "docker" ]]; then
+    var="$(nginx_upstream_var "$key")"
+    printf '%s\n        set $%s %s;\n        proxy_pass $%s$request_uri;' \
+      "$NGINX_DOCKER_RESOLVER" "$var" "$up" "$var"
+  else
+    printf '        proxy_pass %s;' "$up"
+  fi
+}
+
+# proxy_pass с заменой пути на фиксированный ($2, например /ws или /oauth/).
+# Используется там, где префикс локейшна нужно «срезать»/заменить.
+render_proxy_rewrite() {
+  local key="$1" target="$2" up var
+  up="$(nginx_upstream "$key")"
+  if [[ "$NGINX_MODE" == "docker" ]]; then
+    var="$(nginx_upstream_var "$key")"
+    printf '%s\n        set $%s %s;\n        rewrite ^.*$ %s break;\n        proxy_pass $%s;' \
+      "$NGINX_DOCKER_RESOLVER" "$var" "$up" "$target" "$var"
+  else
+    printf '        proxy_pass %s%s;' "$up" "$target"
+  fi
+}
+
+# proxy_pass для /idp-api/ — срезает префикс /idp-api/ и проксирует на корень.
+render_proxy_idp_api() {
+  local key="api" up var
+  up="$(nginx_upstream "$key")"
+  if [[ "$NGINX_MODE" == "docker" ]]; then
+    var="$(nginx_upstream_var "$key")"
+    printf '%s\n        set $%s %s;\n        rewrite ^/idp-api/(.*)$ /$1 break;\n        proxy_pass $%s;' \
+      "$NGINX_DOCKER_RESOLVER" "$var" "$up" "$var"
+  else
+    printf '        proxy_pass %s/;' "$up"
+  fi
+}
+
 nginx_write_conf() {
   local conf="$1"
   if [[ "$NGINX_MODE" == "docker" ]]; then
@@ -1743,11 +1795,11 @@ EOF
 build_ws_block() {
   local ws_on_api="$1"
   [[ "$ws_on_api" != "true" ]] && return 0
-  local upstream
-  upstream="$(nginx_upstream ws)"
+  local proxy_ws
+  proxy_ws="$(render_proxy_rewrite ws /ws)"
   cat <<EOF
     location /ws {
-        proxy_pass ${upstream}/ws;
+${proxy_ws}
         proxy_http_version 1.1;
         proxy_set_header Upgrade \$http_upgrade;
         proxy_set_header Connection "upgrade";
@@ -1767,8 +1819,8 @@ EOF
 # и проставляет CORS-заголовки, отражая Origin (нужно для credentials: cookie/JWT).
 # Заголовки CORS от upstream скрываем, чтобы не было дублей Access-Control-Allow-Origin.
 build_nginx_api_location_block() {
-  local upstream
-  upstream="$(nginx_upstream api)"
+  local proxy_api
+  proxy_api="$(render_proxy_root api)"
   cat <<EOF
     location / {
         set \$cors_origin "";
@@ -1789,7 +1841,7 @@ build_nginx_api_location_block() {
         add_header Access-Control-Allow-Origin \$cors_origin always;
         add_header Access-Control-Allow-Credentials true always;
 
-        proxy_pass ${upstream};
+${proxy_api}
         proxy_http_version 1.1;
 ${nginx_proxy_headers}
     }
@@ -1835,12 +1887,15 @@ EOF
 }
 
 build_nginx_idp_api_proxy_block() {
-  local api_upstream ws_upstream
-  api_upstream="$(nginx_upstream api)"
-  ws_upstream="$(nginx_upstream ws)"
+  local proxy_ws proxy_idp proxy_oauth proxy_wk proxy_fedcm
+  proxy_ws="$(render_proxy_rewrite ws /ws)"
+  proxy_idp="$(render_proxy_idp_api)"
+  proxy_oauth="$(render_proxy_root api)"
+  proxy_wk="$(render_proxy_root api)"
+  proxy_fedcm="$(render_proxy_root api)"
   cat <<EOF
     location /idp-api/ws {
-        proxy_pass ${ws_upstream}/ws;
+${proxy_ws}
         proxy_http_version 1.1;
         proxy_set_header Upgrade \$http_upgrade;
         proxy_set_header Connection "upgrade";
@@ -1852,25 +1907,25 @@ build_nginx_idp_api_proxy_block() {
     }
 
     location /idp-api/ {
-        proxy_pass ${api_upstream}/;
+${proxy_idp}
         proxy_http_version 1.1;
 ${nginx_proxy_headers}
     }
 
     location /oauth/ {
-        proxy_pass ${api_upstream}/oauth/;
+${proxy_oauth}
         proxy_http_version 1.1;
 ${nginx_proxy_headers}
     }
 
     location /.well-known/ {
-        proxy_pass ${api_upstream}/.well-known/;
+${proxy_wk}
         proxy_http_version 1.1;
 ${nginx_proxy_headers}
     }
 
     location /fedcm/ {
-        proxy_pass ${api_upstream}/fedcm/;
+${proxy_fedcm}
         proxy_http_version 1.1;
 ${nginx_proxy_headers}
     }
@@ -1881,9 +1936,9 @@ EOF
 write_nginx_site_frontend() {
   local domain="$1"
   local ssl_type="${2:-none}"
-  local conf upstream http_preamble ssl_block idp_api_block
+  local conf http_preamble ssl_block idp_api_block proxy_root
   conf="$(nginx_conf_target frontend)"
-  upstream="$(nginx_upstream frontend)"
+  proxy_root="$(render_proxy_root frontend)"
   http_preamble="$(nginx_http_server_preamble "$domain" "$ssl_type")"
   idp_api_block="$(build_nginx_idp_api_proxy_block)"
 
@@ -1895,7 +1950,7 @@ server {
     server_name ${domain};
 ${idp_api_block}
     location / {
-        proxy_pass ${upstream};
+${proxy_root}
         proxy_http_version 1.1;
 ${nginx_proxy_headers}
     }
@@ -1912,7 +1967,7 @@ ${ssl_block}
     client_max_body_size 50m;
 ${idp_api_block}
     location / {
-        proxy_pass ${upstream};
+${proxy_root}
         proxy_http_version 1.1;
 ${nginx_proxy_headers}
     }
@@ -1930,9 +1985,9 @@ EOF
 write_nginx_site_fedcm_apex() {
   local domain="$1"
   local ssl_type="${2:-none}"
-  local conf upstream http_preamble ssl_block idp_api_block
+  local conf http_preamble ssl_block idp_api_block proxy_root
   conf="$(nginx_conf_target fedcm-apex)"
-  upstream="$(nginx_upstream frontend)"
+  proxy_root="$(render_proxy_root frontend)"
   http_preamble="$(nginx_http_server_preamble "$domain" "$ssl_type")"
   idp_api_block="$(build_nginx_idp_api_proxy_block)"
 
@@ -1945,7 +2000,7 @@ server {
     client_max_body_size 50m;
 ${idp_api_block}
     location / {
-        proxy_pass ${upstream};
+${proxy_root}
         proxy_http_version 1.1;
 ${nginx_proxy_headers}
     }
@@ -1962,7 +2017,7 @@ ${ssl_block}
     client_max_body_size 50m;
 ${idp_api_block}
     location / {
-        proxy_pass ${upstream};
+${proxy_root}
         proxy_http_version 1.1;
 ${nginx_proxy_headers}
     }
@@ -1975,9 +2030,9 @@ EOF
 write_nginx_site_docs() {
   local domain="$1"
   local ssl_type="${2:-none}"
-  local conf upstream http_preamble ssl_block
+  local conf http_preamble ssl_block proxy_root
   conf="$(nginx_conf_target docs)"
-  upstream="$(nginx_upstream docs)"
+  proxy_root="$(render_proxy_root docs)"
   http_preamble="$(nginx_http_server_preamble "$domain" "$ssl_type")"
 
   if [[ "$ssl_type" == "none" ]]; then
@@ -1988,7 +2043,7 @@ server {
     server_name ${domain};
     location = / { return 302 /docs; }
     location / {
-        proxy_pass ${upstream};
+${proxy_root}
         proxy_http_version 1.1;
 ${nginx_proxy_headers}
     }
@@ -2004,7 +2059,7 @@ ${http_preamble}server {
 ${ssl_block}
     location = / { return 302 /docs; }
     location / {
-        proxy_pass ${upstream};
+${proxy_root}
         proxy_http_version 1.1;
 ${nginx_proxy_headers}
     }
@@ -2017,9 +2072,9 @@ EOF
 write_nginx_site_ws() {
   local domain="$1"
   local ssl_type="${2:-none}"
-  local conf upstream http_preamble ssl_block
+  local conf http_preamble ssl_block proxy_ws
   conf="$(nginx_conf_target ws)"
-  upstream="$(nginx_upstream ws)"
+  proxy_ws="$(render_proxy_rewrite ws /ws)"
   http_preamble="$(nginx_http_server_preamble "$domain" "$ssl_type")"
 
   if [[ "$ssl_type" == "none" ]]; then
@@ -2029,7 +2084,7 @@ server {
     listen [::]:80;
     server_name ${domain};
     location / {
-        proxy_pass ${upstream}/ws;
+${proxy_ws}
         proxy_http_version 1.1;
         proxy_set_header Upgrade \$http_upgrade;
         proxy_set_header Connection "upgrade";
@@ -2050,7 +2105,7 @@ ${http_preamble}server {
     server_name ${domain};
 ${ssl_block}
     location / {
-        proxy_pass ${upstream}/ws;
+${proxy_ws}
         proxy_http_version 1.1;
         proxy_set_header Upgrade \$http_upgrade;
         proxy_set_header Connection "upgrade";
@@ -2071,9 +2126,9 @@ write_nginx_site_minio() {
   local kind="$2"
   local label="$3"
   local ssl_type="${4:-none}"
-  local conf upstream http_preamble ssl_block
+  local conf http_preamble ssl_block proxy_root
   conf="$(nginx_conf_target "$label")"
-  upstream="$(nginx_upstream "$kind")"
+  proxy_root="$(render_proxy_root "$kind")"
   http_preamble="$(nginx_http_server_preamble "$domain" "$ssl_type")"
 
   if [[ "$ssl_type" == "none" ]]; then
@@ -2085,7 +2140,7 @@ server {
     client_max_body_size 1024m;
     proxy_buffering off;
     location / {
-        proxy_pass ${upstream};
+${proxy_root}
         proxy_http_version 1.1;
 ${nginx_proxy_headers}
     }
@@ -2102,7 +2157,7 @@ ${ssl_block}
     client_max_body_size 1024m;
     proxy_buffering off;
     location / {
-        proxy_pass ${upstream};
+${proxy_root}
         proxy_http_version 1.1;
 ${nginx_proxy_headers}
     }