From 7cea73dc0dfdc1cab05cdc12e8e7a4caa16217f9 Mon Sep 17 00:00:00 2001 From: glass beadian Date: Sun, 11 Oct 2026 21:36:20 +0000 Subject: [PATCH] Edge: tailscale0 relay exemption, CT320 transit hop, files/office/intake host parity --- infra/occupymedia/edge/edge-firewall.sh | 19 +++++++ infra/occupymedia/edge/nginx.conf | 67 +++++++++++++++++++++++++ 2 files changed, 86 insertions(+) diff --git a/infra/occupymedia/edge/edge-firewall.sh b/infra/occupymedia/edge/edge-firewall.sh index ba599ab..de12117 100755 --- a/infra/occupymedia/edge/edge-firewall.sh +++ b/infra/occupymedia/edge/edge-firewall.sh @@ -23,6 +23,25 @@ for br in $(ls /sys/class/net/ | grep -E '^(br-|docker0)'); do iptables -I DOCKER-USER 1 -i "$br" -j RETURN done +# The ipfs3 ingress relay arrives over tailscale0 and terminates on the edge +# nginx; exempt it from the CF-ranges-only filter (trusted tailnet source). +iptables -C DOCKER-USER -i tailscale0 -j RETURN 2>/dev/null || \ + iptables -I DOCKER-USER 1 -i tailscale0 -j RETURN + +# Transit hop for occ-files (CT 320): CF-bound traffic from it rides this CT so +# the exit-node failover below covers oCIS blob writes too. Forward + NAT only; +# occ-files adds the CF-range routes toward this CT's LAN IP. +if [ "$(hostname -I 2>/dev/null | awk '{print $1}')" = "192.168.13.221" ]; then + iptables -C FORWARD -s 192.168.13.210 -d 192.168.13.0/24 -j ACCEPT 2>/dev/null || \ + iptables -I FORWARD 1 -s 192.168.13.210 -d 192.168.13.0/24 -j ACCEPT + iptables -C FORWARD -s 192.168.13.210 -j ACCEPT 2>/dev/null || \ + iptables -I FORWARD 1 -s 192.168.13.210 -j ACCEPT + iptables -t nat -C POSTROUTING -s 192.168.13.210 -d 192.168.13.0/24 -j RETURN 2>/dev/null || \ + iptables -t nat -A POSTROUTING -s 192.168.13.210 -d 192.168.13.0/24 -j RETURN + iptables -t nat -C POSTROUTING -s 192.168.13.210 -j MASQUERADE 2>/dev/null || \ + iptables -t nat -A POSTROUTING -s 192.168.13.210 -j MASQUERADE +fi + if [[ $MODE == OPEN ]]; then echo "edge firewall: OPEN (any source allowed on 80/443; nginx SNI gate applies)" exit 0 diff --git a/infra/occupymedia/edge/nginx.conf b/infra/occupymedia/edge/nginx.conf index 8a1e166..5ec1d28 100644 --- a/infra/occupymedia/edge/nginx.conf +++ b/infra/occupymedia/edge/nginx.conf @@ -16,6 +16,9 @@ http { "" close; } + # Lets the remote failover probe tell edge-served responses from tunnel-served. + add_header X-Served-By occ-edge always; + # HTTP: redirect everything to HTTPS. server { listen 80; @@ -125,6 +128,70 @@ http { return 200 "edge-ok"; } + # Parity with the tunnel ingress: occ-files + Collabora live on CT 320. + server { + listen 443 ssl; + listen [::]:443 ssl; + server_name files.occupymedia.cc; + + ssl_certificate /etc/letsencrypt/live/occupymedia.cc/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/occupymedia.cc/privkey.pem; + + client_max_body_size 512m; + location / { + proxy_pass http://192.168.13.210:9200; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto https; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + proxy_read_timeout 3600s; + proxy_send_timeout 3600s; + proxy_buffering off; + } + } + + server { + listen 443 ssl; + listen [::]:443 ssl; + server_name office.occupymedia.cc; + + ssl_certificate /etc/letsencrypt/live/occupymedia.cc/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/occupymedia.cc/privkey.pem; + + location / { + proxy_pass http://192.168.13.210:9980; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto https; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + proxy_read_timeout 3600s; + proxy_send_timeout 3600s; + } + } + + server { + listen 443 ssl; + listen [::]:443 ssl; + server_name intake.occupymedia.cc; + + ssl_certificate /etc/letsencrypt/live/occupymedia.cc/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/occupymedia.cc/privkey.pem; + + client_max_body_size 20m; + location / { + proxy_pass http://occ-intake:3000; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto https; + proxy_read_timeout 60s; + } + } + # Everything else on this IP: drop the connection. server { listen 443 ssl default_server;