Edge: hub-branded oCIS theme + assets for files.occupymedia.cc, both ingress paths; brand assets mount

infra/occupymedia/edge/docker-compose.edge.yml

@@ -9,6 +9,7 @@ services:
       - "443:443"
     volumes:
       - ./nginx.conf:/etc/nginx/nginx.conf:ro
+      - /opt/occ-brand:/opt/occ-brand:ro
       - ./certs:/etc/letsencrypt:ro
 
 networks:

infra/occupymedia/edge/nginx.conf

@@ -173,7 +173,35 @@ http {
     return 200 "edge-ok";
   }
 
-  # Parity with the tunnel ingress: occ-files + Collabora live on CT 320.
+  # Hub branding overrides for the oCIS web client: theme json + assets are
+  # served by the edge; every other path proxies into oCIS. Also the tunnel
+  # origin path (:80) so both ingress paths get the same branding.
+  server {
+    listen 80;
+    listen [::]:80;
+    server_name files.occupymedia.cc;
+    location = /themes/owncloud/theme.json {
+      default_type application/json;
+      alias /opt/occ-brand/hub-theme.json;
+    }
+    location /themes/owncloud/assets/ {
+      alias /opt/occ-brand/;
+    }
+    location / {
+      proxy_pass http://192.168.13.210:9200;
+      proxy_http_version 1.1;
+      proxy_set_header Host $host;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header X-Forwarded-Proto http;
+      proxy_set_header Upgrade $http_upgrade;
+      proxy_set_header Connection $connection_upgrade;
+      proxy_read_timeout 3600s;
+      proxy_send_timeout 3600s;
+      proxy_buffering off;
+      client_max_body_size 512m;
+    }
+  }
+
   server {
     listen 443 ssl;
     listen [::]:443 ssl;
@@ -183,6 +211,13 @@ http {
     ssl_certificate_key /etc/letsencrypt/live/occupymedia.cc/privkey.pem;
 
     client_max_body_size 512m;
+    location = /themes/owncloud/theme.json {
+      default_type application/json;
+      alias /opt/occ-brand/hub-theme.json;
+    }
+    location /themes/owncloud/assets/ {
+      alias /opt/occ-brand/;
+    }
     location / {
       proxy_pass http://192.168.13.210:9200;
       proxy_http_version 1.1;