fabi/Schulcloud-MCP
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
a3aded110cf15a998d6e614dcb40d585883d07fa
Schulcloud-MCP/local-instance/proxy/nginx.conf
MechaCat02 a3aded110c Add a local Schulcloud instance modelled on the live target 
A Docker Compose stack that runs the deployed images
(quay.io/schulcloudverbund/*, thr theme, tag 33.40 — the versions
schulcloud-thueringen.de reports) rather than a rebuild of main, so what we
develop against is the deployed artefact. It exists to produce the states we
can otherwise only observe read-only: log in as the teacher, grade, then read
it back the way the MCP server does.

Faithful where it matters and honest where it isn't:

- Feature flags in env/api.env are a replay of GET /api/v3/config/public from
  the live instance, not a hand-picked set; instance identity mirrors the thr
  group_vars from dof_app_deploy.
- The proxy is generated from the deployment's own ingress table
  (scripts/gen-proxy-conf.py) so the legacy-client / SPA / API path split
  matches production; getting it wrong tests a different application.
- Valkey runs in `single` mode so the JWT whitelist expires sessions the way
  production does, rather than the in-memory shortcut that hides it.
- No external OAuth / Schulportal login (excluded by request and not
  reproducible locally), no BigBlueButton; each divergence is marked at the
  line it affects. Everything binds to 127.0.0.1 and uses the upstream dev
  credentials, which are public.

Profiles keep the heavy pieces opt-in: `tools` adds Etherpad/H5P/tldraw/
Collabora, `av` adds ClamAV, `preview` adds thumbnailing.

seed.sh loads the upstream demo school (the same call the deployment's init job
makes) and registers MinIO as the legacy storage provider, which has no seed
data on purpose. The demo data already contains the grading states that are
hard to obtain from the real account — a feedback-only grade and a 100% one —
which is what surfaced the past-due submitted-text scrape gap.

One config finding baked in: file-storage and h5p validate a token's
issuer/audience against JWT_DOMAIN (default "localhost"), while the API stamps
SC_DOMAIN; without keeping them equal, the homework page's file lookups 401.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-09-13 14:17:30 +02:00

586 lines
18 KiB
Nginx Configuration File
Raw Blame History

# GENERATED by scripts/gen-proxy-conf.py — do not edit by hand.
#
# One origin in front of the whole stack, the way the real instance is fronted
# by its Kubernetes ingress. The path split between the legacy client and the
# new SPA is not cosmetic: get it wrong and you are testing a different
# application from the one the students use.
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
server {
listen 4400;
server_name localhost;
# Docker's embedded DNS. Every proxy_pass below goes through a variable so
# that names resolve per request rather than at startup — otherwise this
# container refuses to boot whenever an optional profile (tools, av) is
# down, which is the normal case.
resolver 127.0.0.11 valid=10s ipv6=off;
# Course files and H5P uploads are large; the ingress allows the same.
client_max_body_size 2600m;
proxy_read_timeout 300s;
proxy_send_timeout 300s;
# version-aggregator-svc upstream; /serverversion and /nuxtversion are the
# real per-app endpoints and are routed below.
location = /version {
default_type application/json;
return 200 '{"local-instance":true,"see":["/serverversion","/nuxtversion"]}';
}
# --- service-owned ingresses and websockets ---
location /api/v3/file/ {
set $up_api_v3_file file-storage:4444;
proxy_pass http://$up_api_v3_file;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
location /api/v3/wopi/ {
set $up_api_v3_wopi file-storage:4444;
proxy_pass http://$up_api_v3_wopi;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
location /api/v3/h5p-editor/h5pstatics/ {
set $up_api_v3_h5p_editor_h5pstatics h5p-staticfiles:8080;
rewrite ^/api/v3/h5p-editor/h5pstatics/(.*)$ /h5pstatics/$1 break;
proxy_pass http://$up_api_v3_h5p_editor_h5pstatics;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
location /api/v3/h5p-editor/ {
set $up_api_v3_h5p_editor h5p-editor:4448;
proxy_pass http://$up_api_v3_h5p_editor;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
location /api/v3/ {
set $up_api_v3 api:3030;
proxy_pass http://$up_api_v3;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
location /admin/api/v1 {
set $up_admin_api_v1 admin-api:4030;
proxy_pass http://$up_admin_api_v1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
location /board-collaboration {
set $up_board_collaboration board-collaboration:4450;
proxy_pass http://$up_board_collaboration;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
}
location /tldraw-server {
set $up_tldraw_server tldraw-server:3345;
proxy_pass http://$up_tldraw_server;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
}
location /api/tldraw {
set $up_api_tldraw tldraw-server:3345;
proxy_pass http://$up_api_tldraw;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# --- from dof_app_deploy x_ingress.yml ---
# default
location / {
set $up_root client:3100;
proxy_pass http://$up_root;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# themes
location /favicon.png {
set $up_favicon_png nuxt:4000;
proxy_pass http://$up_favicon_png;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# bbb_presentation_pdf
location /bbb-presentation.pdf {
set $up_bbb_presentation_pdf nuxt:4000;
proxy_pass http://$up_bbb_presentation_pdf;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# runtime
location /runtime.config.json {
set $up_runtime_config_json nuxt:4000;
proxy_pass http://$up_runtime_config_json;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# metrics
location /metrics {
return 404;
}
# login
location /login {
set $up_login client:3100;
proxy_pass http://$up_login;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# error
location /error {
set $up_error nuxt:4000;
proxy_pass http://$up_error;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# imprint
location /imprint {
set $up_imprint nuxt:4000;
proxy_pass http://$up_imprint;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# mint-ec
location /mint-ec {
set $up_mint_ec nuxt:4000;
proxy_pass http://$up_mint_ec;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# news
location /news {
set $up_news nuxt:4000;
proxy_pass http://$up_news;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# tasks
location /tasks {
set $up_tasks nuxt:4000;
proxy_pass http://$up_tasks;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# nuxtversion
location /nuxtversion {
set $up_nuxtversion nuxt:4000;
proxy_pass http://$up_nuxtversion;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# content
location /content {
set $up_content nuxt:4000;
proxy_pass http://$up_content;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# _nuxt
location /_nuxt {
set $up__nuxt nuxt:4000;
proxy_pass http://$up__nuxt;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# administration_ldap
location /administration/ldap {
set $up_administration_ldap nuxt:4000;
proxy_pass http://$up_administration_ldap;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# administration_migration
location /administration/migration {
set $up_administration_migration nuxt:4000;
proxy_pass http://$up_administration_migration;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# administration_school-settings
location /administration/school-settings {
set $up_administration_school_settings nuxt:4000;
proxy_pass http://$up_administration_school_settings;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# administration_students
location /administration/students {
set $up_administration_students nuxt:4000;
proxy_pass http://$up_administration_students;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# administration_teachers
location /administration/teachers {
set $up_administration_teachers nuxt:4000;
proxy_pass http://$up_administration_teachers;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# administration_rooms
location /administration/rooms/manage {
set $up_administration_rooms_manage nuxt:4000;
proxy_pass http://$up_administration_rooms_manage;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# administration_groups_classes
location /administration/groups/classes {
set $up_administration_groups_classes nuxt:4000;
proxy_pass http://$up_administration_groups_classes;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# boards
location /boards {
set $up_boards nuxt:4000;
proxy_pass http://$up_boards;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# administration_rooms_new
location /administration/rooms/new {
set $up_administration_rooms_new nuxt:4000;
proxy_pass http://$up_administration_rooms_new;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# rooms-overview
location /rooms-overview {
set $up_rooms_overview nuxt:4000;
proxy_pass http://$up_rooms_overview;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# dashboard
location /dashboard {
set $up_dashboard nuxt:4000;
proxy_pass http://$up_dashboard;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# rooms
location /rooms {
set $up_rooms nuxt:4000;
proxy_pass http://$up_rooms;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# folder
location /folder {
set $up_folder nuxt:4000;
proxy_pass http://$up_folder;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# collabora
location /collabora {
set $up_collabora nuxt:4000;
proxy_pass http://$up_collabora;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# h5p-player
location /h5p/player {
set $up_h5p_player nuxt:4000;
proxy_pass http://$up_h5p_player;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# h5p-editor
location /h5p/editor {
set $up_h5p_editor nuxt:4000;
proxy_pass http://$up_h5p_editor;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# migration
location /migration {
set $up_migration nuxt:4000;
proxy_pass http://$up_migration;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# tools_context
location /tools/context {
set $up_tools_context nuxt:4000;
proxy_pass http://$up_tools_context;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# media_shelf
location /media-shelf {
set $up_media_shelf nuxt:4000;
proxy_pass http://$up_media_shelf;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# licenses
location /licenses {
set $up_licenses nuxt:4000;
proxy_pass http://$up_licenses;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# registration-external-members
location /registration-external-members {
set $up_registration_external_members nuxt:4000;
proxy_pass http://$up_registration_external_members;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# security
location /system/security {
set $up_system_security nuxt:4000;
proxy_pass http://$up_system_security;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# api
location /api {
return 404;
}
# api_v1_roster
location /api/v1/roster {
return 404;
}
# api_v1_consentVersions
location /api/v1/consentVersions {
set $up_api_v1_consentVersions api:3030;
proxy_pass http://$up_api_v1_consentVersions;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# api_v1_ldap-config
location /api/v1/ldap-config {
set $up_api_v1_ldap_config api:3030;
proxy_pass http://$up_api_v1_ldap_config;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# api_version
location /serverversion {
set $up_serverversion api:3030;
proxy_pass http://$up_serverversion;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# api_v1_courses
location /api/v1/courses {
set $up_api_v1_courses api:3030;
proxy_pass http://$up_api_v1_courses;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# api_v1_users
location /api/v1/users {
set $up_api_v1_users api:3030;
proxy_pass http://$up_api_v1_users;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# api_v1_classes
location /api/v1/classes {
set $up_api_v1_classes api:3030;
proxy_pass http://$up_api_v1_classes;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
location ^~ /etherpad/admin { return 404; }
location ^~ /etherpad/stats { return 404; }
location /etherpad/socket.io {
set $up_etherpad etherpad:9001;
rewrite /etherpad/socket.io/(.*) /socket.io/$1 break;
proxy_pass http://$up_etherpad;
proxy_redirect / /etherpad/;
proxy_set_header Host $http_host;
proxy_buffering off;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
}
location /etherpad {
set $up_etherpad etherpad:9001;
rewrite ^/etherpad$ /etherpad/ permanent;
rewrite /etherpad/(.*) /$1 break;
proxy_pass http://$up_etherpad;
proxy_pass_header Server;
proxy_redirect / /etherpad/;
proxy_set_header Host $host;
proxy_buffering off;
}
# version_aggregator
location /version {
return 404;
}
}
Reference in New Issue View Git Blame Copy Permalink