Sergey Antropoff
48df10b17e
- Harden DB-backed handlers and seed profiles; align client wire shapes for cluster resources, QEMU config, and node SSL fields - Serve plain HTTP on Compose :8006; keep TLS optional (--profile tls) and terminate HTTPS at Kubernetes Ingress - Add pulumi-tests (full contract surface majors 6–9 + BPG lifecycle) and make pulumi-tests - Ship bilingual docs, CHANGELOG, SECURITY, CONTRIBUTING, and GitHub Actions (make ci + Compose/Helm validation)
46 lines
1.5 KiB
Plaintext
46 lines
1.5 KiB
Plaintext
# Optional / internal TLS terminator.
|
|
#
|
|
# - Host lab default is plain HTTP :8006 on the simulator (no TLS).
|
|
# - Kubernetes HTTPS terminates at Ingress (cert-manager).
|
|
# - This gateway is for HTTPS-only clients (proxmoxer, pulumi-proxmoxve).
|
|
# - Also listen on :80: some bridged providers rewrite https://host:8443 → http://host
|
|
# on later requests (delete); without :80 those calls fail.
|
|
|
|
server {
|
|
listen 80;
|
|
server_name _;
|
|
resolver 127.0.0.11 valid=10s ipv6=off;
|
|
location / {
|
|
set $upstream simulator:8006;
|
|
proxy_pass http://$upstream;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Request-ID $request_id;
|
|
}
|
|
}
|
|
|
|
server {
|
|
listen 8443 ssl;
|
|
server_name _;
|
|
|
|
ssl_certificate /etc/nginx/tls/server.crt;
|
|
ssl_certificate_key /etc/nginx/tls/server.key;
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
|
|
resolver 127.0.0.11 valid=10s ipv6=off;
|
|
|
|
location / {
|
|
set $upstream simulator:8006;
|
|
proxy_pass http://$upstream;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
proxy_set_header X-Request-ID $request_id;
|
|
}
|
|
}
|