Schulcloud-MCP/local-instance/proxy/nginx.conf

# GENERATED by scripts/gen-proxy-conf.py — do not edit by hand.
#
# One origin in front of the whole stack, the way the real instance is fronted
# by its Kubernetes ingress. The path split between the legacy client and the
# new SPA is not cosmetic: get it wrong and you are testing a different
# application from the one the students use.

map $http_upgrade $connection_upgrade {
	default upgrade;
	''      close;
}

server {
	listen 4400;
	server_name localhost;

	# Docker's embedded DNS. Every proxy_pass below goes through a variable so
	# that names resolve per request rather than at startup — otherwise this
	# container refuses to boot whenever an optional profile (tools, av) is
	# down, which is the normal case.
	resolver 127.0.0.11 valid=10s ipv6=off;

	# Course files and H5P uploads are large; the ingress allows the same.
	client_max_body_size 2600m;
	proxy_read_timeout 300s;
	proxy_send_timeout 300s;

	# The legacy client sets several large cookies at once (jwt plus the
	# Etherpad session it requests on every topic page), which overflows
	# nginx's default 4k header buffer: the upstream answers 200 and the proxy
	# still returns 502 with "upstream sent too big header". Topic pages are
	# the visible casualty, and because the MCP server's topic-page scrape
	# degrades to an empty list by design, the ids it recovers just silently
	# vanish rather than erroring.
	proxy_buffer_size 32k;
	proxy_buffers 8 32k;
	proxy_busy_buffers_size 64k;

	# version-aggregator-svc upstream; /serverversion and /nuxtversion are the
	# real per-app endpoints and are routed below.
	location = /version {
		default_type application/json;
		return 200 '{"local-instance":true,"see":["/serverversion","/nuxtversion"]}';
	}

	# --- service-owned ingresses and websockets ---

	location /api/v3/file/ {
		set $up_api_v3_file file-storage:4444;
		proxy_pass http://$up_api_v3_file;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	location /api/v3/wopi/ {
		set $up_api_v3_wopi file-storage:4444;
		proxy_pass http://$up_api_v3_wopi;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	location /api/v3/h5p-editor/h5pstatics/ {
		set $up_api_v3_h5p_editor_h5pstatics h5p-staticfiles:8080;
		rewrite ^/api/v3/h5p-editor/h5pstatics/(.*)$ /h5pstatics/$1 break;
		proxy_pass http://$up_api_v3_h5p_editor_h5pstatics;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	location /api/v3/h5p-editor/ {
		set $up_api_v3_h5p_editor h5p-editor:4448;
		proxy_pass http://$up_api_v3_h5p_editor;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	location /api/v3/ {
		set $up_api_v3 api:3030;
		proxy_pass http://$up_api_v3;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	location /admin/api/v1 {
		set $up_admin_api_v1 admin-api:4030;
		proxy_pass http://$up_admin_api_v1;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	location /board-collaboration {
		set $up_board_collaboration board-collaboration:4450;
		proxy_pass http://$up_board_collaboration;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
		proxy_http_version 1.1;
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection $connection_upgrade;
	}

	location /tldraw-server {
		set $up_tldraw_server tldraw-server:3345;
		proxy_pass http://$up_tldraw_server;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
		proxy_http_version 1.1;
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection $connection_upgrade;
	}

	location /api/tldraw {
		set $up_api_tldraw tldraw-server:3345;
		proxy_pass http://$up_api_tldraw;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# --- from dof_app_deploy x_ingress.yml ---

	# default
	location / {
		set $up_root client:3100;
		proxy_pass http://$up_root;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# themes
	location /favicon.png {
		set $up_favicon_png nuxt:4000;
		proxy_pass http://$up_favicon_png;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# bbb_presentation_pdf
	location /bbb-presentation.pdf {
		set $up_bbb_presentation_pdf nuxt:4000;
		proxy_pass http://$up_bbb_presentation_pdf;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# runtime
	location /runtime.config.json {
		set $up_runtime_config_json nuxt:4000;
		proxy_pass http://$up_runtime_config_json;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# metrics
	location /metrics {
		return 404;
	}

	# login
	location /login {
		set $up_login client:3100;
		proxy_pass http://$up_login;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# error
	location /error {
		set $up_error nuxt:4000;
		proxy_pass http://$up_error;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# imprint
	location /imprint {
		set $up_imprint nuxt:4000;
		proxy_pass http://$up_imprint;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# mint-ec
	location /mint-ec {
		set $up_mint_ec nuxt:4000;
		proxy_pass http://$up_mint_ec;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# news
	location /news {
		set $up_news nuxt:4000;
		proxy_pass http://$up_news;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# tasks
	location /tasks {
		set $up_tasks nuxt:4000;
		proxy_pass http://$up_tasks;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# nuxtversion
	location /nuxtversion {
		set $up_nuxtversion nuxt:4000;
		proxy_pass http://$up_nuxtversion;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# content
	location /content {
		set $up_content nuxt:4000;
		proxy_pass http://$up_content;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# _nuxt
	location /_nuxt {
		set $up__nuxt nuxt:4000;
		proxy_pass http://$up__nuxt;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# administration_ldap
	location /administration/ldap {
		set $up_administration_ldap nuxt:4000;
		proxy_pass http://$up_administration_ldap;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# administration_migration
	location /administration/migration {
		set $up_administration_migration nuxt:4000;
		proxy_pass http://$up_administration_migration;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# administration_school-settings
	location /administration/school-settings {
		set $up_administration_school_settings nuxt:4000;
		proxy_pass http://$up_administration_school_settings;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# administration_students
	location /administration/students {
		set $up_administration_students nuxt:4000;
		proxy_pass http://$up_administration_students;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# administration_teachers
	location /administration/teachers {
		set $up_administration_teachers nuxt:4000;
		proxy_pass http://$up_administration_teachers;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# administration_rooms
	location /administration/rooms/manage {
		set $up_administration_rooms_manage nuxt:4000;
		proxy_pass http://$up_administration_rooms_manage;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# administration_groups_classes
	location /administration/groups/classes {
		set $up_administration_groups_classes nuxt:4000;
		proxy_pass http://$up_administration_groups_classes;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# boards
	location /boards {
		set $up_boards nuxt:4000;
		proxy_pass http://$up_boards;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# administration_rooms_new
	location /administration/rooms/new {
		set $up_administration_rooms_new nuxt:4000;
		proxy_pass http://$up_administration_rooms_new;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# rooms-overview
	location /rooms-overview {
		set $up_rooms_overview nuxt:4000;
		proxy_pass http://$up_rooms_overview;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# dashboard
	location /dashboard {
		set $up_dashboard nuxt:4000;
		proxy_pass http://$up_dashboard;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# rooms
	location /rooms {
		set $up_rooms nuxt:4000;
		proxy_pass http://$up_rooms;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# folder
	location /folder {
		set $up_folder nuxt:4000;
		proxy_pass http://$up_folder;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# collabora
	location /collabora {
		set $up_collabora nuxt:4000;
		proxy_pass http://$up_collabora;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# h5p-player
	location /h5p/player {
		set $up_h5p_player nuxt:4000;
		proxy_pass http://$up_h5p_player;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# h5p-editor
	location /h5p/editor {
		set $up_h5p_editor nuxt:4000;
		proxy_pass http://$up_h5p_editor;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# migration
	location /migration {
		set $up_migration nuxt:4000;
		proxy_pass http://$up_migration;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# tools_context
	location /tools/context {
		set $up_tools_context nuxt:4000;
		proxy_pass http://$up_tools_context;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# media_shelf
	location /media-shelf {
		set $up_media_shelf nuxt:4000;
		proxy_pass http://$up_media_shelf;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# licenses
	location /licenses {
		set $up_licenses nuxt:4000;
		proxy_pass http://$up_licenses;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# registration-external-members
	location /registration-external-members {
		set $up_registration_external_members nuxt:4000;
		proxy_pass http://$up_registration_external_members;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# security
	location /system/security {
		set $up_system_security nuxt:4000;
		proxy_pass http://$up_system_security;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# api
	location /api {
		return 404;
	}

	# api_v1_roster
	location /api/v1/roster {
		return 404;
	}

	# api_v1_consentVersions
	location /api/v1/consentVersions {
		set $up_api_v1_consentVersions api:3030;
		proxy_pass http://$up_api_v1_consentVersions;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# api_v1_ldap-config
	location /api/v1/ldap-config {
		set $up_api_v1_ldap_config api:3030;
		proxy_pass http://$up_api_v1_ldap_config;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# api_version
	location /serverversion {
		set $up_serverversion api:3030;
		proxy_pass http://$up_serverversion;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# api_v1_courses
	location /api/v1/courses {
		set $up_api_v1_courses api:3030;
		proxy_pass http://$up_api_v1_courses;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# api_v1_users
	location /api/v1/users {
		set $up_api_v1_users api:3030;
		proxy_pass http://$up_api_v1_users;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# api_v1_classes
	location /api/v1/classes {
		set $up_api_v1_classes api:3030;
		proxy_pass http://$up_api_v1_classes;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	location ^~ /etherpad/admin { return 404; }
	location ^~ /etherpad/stats { return 404; }

	location /etherpad/socket.io {
		set $up_etherpad etherpad:9001;
		rewrite /etherpad/socket.io/(.*) /socket.io/$1 break;
		proxy_pass http://$up_etherpad;
		proxy_redirect / /etherpad/;
		proxy_set_header Host $http_host;
		proxy_buffering off;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $remote_addr;
		proxy_set_header X-Forwarded-Proto $scheme;
		proxy_http_version 1.1;
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection $connection_upgrade;
	}

	location /etherpad {
		set $up_etherpad etherpad:9001;
		rewrite ^/etherpad$ /etherpad/ permanent;
		rewrite /etherpad/(.*) /$1 break;
		proxy_pass http://$up_etherpad;
		proxy_pass_header Server;
		proxy_redirect / /etherpad/;
		proxy_set_header Host $host;
		proxy_buffering off;
	}

	# version_aggregator
	location /version {
		return 404;
	}
}