48 lines
1.8 KiB
Text
48 lines
1.8 KiB
Text
|
# prometheus.x — the standalone service, served by this VPS.
|
||
|
|
#
|
||
|
|
# BCNR serves this name via its `ip`+`tls` records: Theseus and Ariadne
|
||
|
|
# resolve prometheus.x by fetching the on-chain record, which says
|
||
|
|
# "connect to <this IP>, pin the TLS cert whose DER sha256 equals <this
|
||
|
|
# fingerprint>". The resolver reverse-proxies to this vhost; a browser
|
||
|
|
# with Ariadne's Thread installed does the same.
|
||
|
|
#
|
||
|
|
# The cert is self-signed and pinned on chain — no CA is involved and
|
||
|
|
# none needs to be, which is a narrower claim than a CA makes and does
|
||
|
|
# not expire on anyone else's schedule. Rotating is one record update.
|
||
|
|
#
|
||
|
|
# To regenerate the cert and read out its DER sha256:
|
||
|
|
# bash /opt/prometheus/deploy/make-tls-cert.sh
|
||
|
|
#
|
||
|
|
# The vhost listens only on HTTPS; the on-chain `tls` pin means plain
|
||
|
|
# HTTP would be refused by the resolver anyway, and we do not want a
|
||
|
|
# scanner to be able to read ANYTHING here over cleartext.
|
||
|
|
|
||
|
|
server {
|
||
|
|
listen 443 ssl;
|
||
|
|
listen [::]:443 ssl;
|
||
|
|
http2 on;
|
||
|
|
server_name prometheus.x;
|
||
|
|
|
||
|
|
ssl_certificate /etc/ssl/prometheus-x/fullchain.pem;
|
||
|
|
ssl_certificate_key /etc/ssl/prometheus-x/privkey.pem;
|
||
|
|
|
||
|
|
# The TLS resolver reaches us over the raw IP but passes `prometheus.x`
|
||
|
|
# as the Host header. The service's canonical URL generator looks at
|
||
|
|
# that header; preserving it keeps rel=canonical honest.
|
||
|
|
location / {
|
||
|
|
proxy_pass http://127.0.0.1:3700;
|
||
|
|
proxy_http_version 1.1;
|
||
|
|
proxy_set_header Host $host;
|
||
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
|
|
proxy_set_header X-Forwarded-Proto https;
|
||
|
|
|
||
|
|
# Publishers upload binaries that can be hundreds of MB. 2 GiB
|
||
|
|
# matches the service's own cap in uploads.js.
|
||
|
|
client_max_body_size 2g;
|
||
|
|
proxy_request_buffering off;
|
||
|
|
|
||
|
|
proxy_buffering off;
|
||
|
|
proxy_read_timeout 120s;
|
||
|
|
}
|
||
|
|
}
|