hacklab/T-HUB
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: in-app Chat (Matrix JWT SSO) + Drive (embedded oCIS)

Browse source 
- api: matrix-sso module (tuwunel jwt -> login/get_token), POST /matrix/session, GET /matrix/identity, drive controller
- web: /chat full-height Element view, /files Library+Drive tabs, embedded-app frame component
- edge: /hub-sso.html handshake route (origin-pinned CSP), X-Frame-Options strip on files
- oCIS: csp.yaml frame-ancestors app.occupymedia.cc
- server config still required: tuwunel [global.jwt], MATRIX_SSO_JWT_SECRET, oCIS restart
This commit is contained in:
glass beadian 2026-10-13 14:57:07 +00:00
parent a2aa70c961
commit fe5f2403d6
22 changed files with 1057 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

22
infra/occupymedia/edge/nginx.conf
View file

@ -118,6 +118,14 @@ http {
default_type application/json;
return 200 '{"m.homeserver":{"base_url":"https://chat.occupymedia.cc"}}';
}
# Hub in-app Chat: sign-in bootstrap on Element's own origin (see hub-sso/chat-sso.html).
location = /hub-sso.html {
alias /opt/hub-sso/chat-sso.html;
default_type text/html;
add_header X-Served-By occ-edge always;
add_header Cache-Control "no-store" always;
add_header Content-Security-Policy "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; frame-ancestors https://app.occupymedia.cc" always;
}
location / {
proxy_pass http://occ-element:80;
proxy_http_version 1.1;
@ -154,6 +162,14 @@ http {
default_type application/json;
return 200 '{"m.server":"chat.occupymedia.cc:443"}';
}
# Hub in-app Chat: sign-in bootstrap on Element's own origin (see hub-sso/chat-sso.html).
location = /hub-sso.html {
alias /opt/hub-sso/chat-sso.html;
default_type text/html;
add_header X-Served-By occ-edge always;
add_header Cache-Control "no-store" always;
add_header Content-Security-Policy "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; frame-ancestors https://app.occupymedia.cc" always;
}
location / {
proxy_pass http://occ-element:80;
proxy_http_version 1.1;
@ -189,6 +205,9 @@ http {
}
location / {
proxy_pass http://192.168.13.210:9200;
# Hub in-app Drive frames oCIS web from app.occupymedia.cc: framing policy
# lives in oCIS csp.yaml (frame-ancestors); drop the legacy SAMEORIGIN.
proxy_hide_header X-Frame-Options;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@ -220,6 +239,9 @@ http {
}
location / {
proxy_pass http://192.168.13.210:9200;
# Hub in-app Drive frames oCIS web from app.occupymedia.cc: framing policy
# lives in oCIS csp.yaml (frame-ancestors); drop the legacy SAMEORIGIN.
proxy_hide_header X-Frame-Options;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;