From 7b455cd43149834ccd2163b4e5d197809bd34a37 Mon Sep 17 00:00:00 2001 From: Matthias Andreas Benkard Date: Sun, 9 Aug 2026 08:33:37 +0200 Subject: Add a public web front end alongside the CLI Extracts the CLI pipeline into a reusable Pipeline class and exposes it via a dependency-free JDK HttpServer (upload form, bounded worker pool with 503 on overload, per-request size/time limits, no persisted uploads), plus nginx/systemd deploy templates and Impressum/Datenschutz placeholders for public operation. Change-Id: I6e8e7afa3c4b1082cdf9e82da0fae0b5b49470ad --- deploy/nginx-aendggner.conf | 39 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 deploy/nginx-aendggner.conf (limited to 'deploy/nginx-aendggner.conf') diff --git a/deploy/nginx-aendggner.conf b/deploy/nginx-aendggner.conf new file mode 100644 index 0000000..f4667fb --- /dev/null +++ b/deploy/nginx-aendggner.conf @@ -0,0 +1,39 @@ +# Reverse-Proxy-Vorlage für den ÄndGgner-Webserver. Übernimmt TLS-Terminierung und +# Rate-Limiting; der Java-Prozess selbst bindet nur an 127.0.0.1 (siehe aendggner-web.service). +# +# Vor dem Einsatz anpassen: server_name, ssl_certificate(_key) (z. B. via certbot). + +limit_req_zone $binary_remote_addr zone=aendggner:10m rate=10r/m; + +server { + listen 80; + listen [::]:80; + server_name aendggner.example.org; + return 301 https://$host$request_uri; +} + +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + server_name aendggner.example.org; + + ssl_certificate /etc/letsencrypt/live/aendggner.example.org/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/aendggner.example.org/privkey.pem; + + # Muss zum Upload-Limit von UploadHandler (MAX_BODY_BYTES, aktuell 40 MB) passen. + client_max_body_size 40m; + + location / { + limit_req zone=aendggner burst=5 nodelay; + + proxy_pass http://127.0.0.1:8080; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + # Etwas großzügiger als der 30s-Timeout der Anwendung, damit deren eigene + # 504-Antwort den Nutzer erreicht statt eines nginx-eigenen Timeouts. + proxy_read_timeout 35s; + } +} -- cgit v1.2.1