mirror of
https://github.com/readest/readest.git
synced 2026-08-21 06:54:23 +00:00
73e933eb33
* fix(docker): apply db migrations on first boot and let the font CDN be overridden (#5550) A fresh self-hosted stack only ran volumes/db/init/schema.sql, so the incremental files under volumes/db/migrations never reached the database. Deployments came up without files.replica_id, the replicas table and the claim_inbox_item RPC, which broke uploads, replica sync and Send to Readest. Mount the migrations directory into the db container together with an apply-migrations.sh hook named so it sorts after the supabase image's own migrate.sh. It globs the mounted directory, so a new migration file needs no compose change, and it records what it applied in readest_meta.migrations so it can be re-run by hand after an upgrade. The reader also loaded its CJK webfont bundles from storage.readest.com, which only sends CORS headers for readest.com origins, so they were blocked on a custom domain. Read the base URL from runtime config via FONT_BASE_URL and keep the CDN as the default. Let SUPABASE_PUBLIC_URL and S3_PUBLIC_ENDPOINT be set directly instead of only being derived from HOST_IP, so the stack can be served from one HTTPS origin. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs(docker): add an example nginx config for a single HTTPS origin Keeps the template out of the README as a copyable file next to .env.example. Routes / to the client, /auth/v1 and /rest/v1 to kong, and the bucket prefix to minio with the Host header preserved so presigned signatures still verify. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
64 lines
2.6 KiB
Text
64 lines
2.6 KiB
Text
# Example nginx site config for serving the compose stack from one HTTPS origin.
|
|
#
|
|
# Copy to your nginx sites directory, replace your-domain.com and the certificate
|
|
# paths, then set the matching values in docker/.env (see README).
|
|
#
|
|
# Everything lives on a single origin, so the browser never makes a cross-origin
|
|
# request and none of the CORS configuration below the proxy has to change.
|
|
# The upstream ports are the compose defaults; consider binding them to loopback
|
|
# (127.0.0.1:3000:3000 and so on) so only nginx can reach them.
|
|
|
|
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
server_name your-domain.com;
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl;
|
|
listen [::]:443 ssl;
|
|
# nginx < 1.25.1 wants `listen 443 ssl http2;` above instead of this line.
|
|
http2 on;
|
|
server_name your-domain.com;
|
|
|
|
ssl_certificate /etc/letsencrypt/live/your-domain.com/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/your-domain.com/privkey.pem;
|
|
|
|
# Readest web client. Only small JSON bodies pass through here: book uploads
|
|
# go straight to MinIO with a presigned URL, not through this location.
|
|
location / {
|
|
proxy_pass http://127.0.0.1:3000;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
|
|
# Supabase through kong. supabase-js appends /auth/v1 and /rest/v1 to
|
|
# SUPABASE_PUBLIC_URL, and kong declares routes on exactly those prefixes.
|
|
location ~ ^/(auth|rest)/v1/ {
|
|
proxy_pass http://127.0.0.1:8000;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
|
|
# MinIO. The presigned URLs are path-style, so the bucket name is the first
|
|
# path segment: this must match S3_BUCKET_NAME. Host has to be forwarded
|
|
# unchanged or the presigned signature will not verify, and the body limit
|
|
# has to be lifted or large books are truncated on upload.
|
|
location /readest-files/ {
|
|
proxy_pass http://127.0.0.1:9000;
|
|
proxy_set_header Host $host;
|
|
client_max_body_size 0;
|
|
proxy_request_buffering off;
|
|
}
|
|
|
|
# Optional: serve mirrored CJK webfont bundles yourself and point the client
|
|
# at them with FONT_BASE_URL=https://your-domain.com/fonts (see README).
|
|
# location /fonts/ {
|
|
# alias /srv/readest-fonts/;
|
|
# }
|
|
}
|