bbef07c825
Two bugs under one roof.
The visible one: a publisher uploading anything over 10 MB on the live
site got "Network error — Unexpected token '<'" in the browser console.
Cause: the Caddy block I wrote for prometheus.x had
`request_body { max_size 2GB }` nested inside the handle block, where it
is a syntax Caddy parses but does not apply, so Caddy's own 10 MB
default was still the gate. Any oversize POST got Caddy's HTML 413 page,
which the browser's JSON parser choked on at the leading `<`.
Fix: moved `request_body { max_size … }` to the top of the prometheus.x
site block (outside `handle`), where Caddy actually honours it. The live
Caddyfile on p2pexchange is already patched + reloaded; a 50 MB upload
verified through the end-to-end path (Caddy → service → clamd → signed
scan report).
The scope one: 2 GiB was more than Prometheus should offer to publishers
at launch. Mobile apps are usually ~100 MB and even most desktop
installers come in well under 200 MiB. Dropping to 200 MiB:
- Fits every Android APK and most desktop installers.
- Shrinks the operator's Sia storage bill (fewer accidental Steam-size
uploads).
- Keeps the "publishers of larger binaries self-host and submit a
manifest with the external URL + SHA" escape hatch — the scanner
still fetches the URL and checks the hash, so a 5 GB game isn't
locked out, Prometheus just doesn't eat its storage.
Changes:
service/uploads.js MAX_FILE_BYTES default: 2 GiB → 200 MiB
service/pages.js /submit step-1 subtitle: "any size up to
2 GiB" → "up to 200 MiB"
deploy/prometheus-x.conf (unused angie fallback) 2g → 200m
deploy/apps-silentmode-st.conf (unused angie fallback) 2g → 200m
PROMETHEUS_MAX_UPLOAD_BYTES env still overrides per-instance.
62 lines
2.4 KiB
Text
62 lines
2.4 KiB
Text
# apps.silentmode.st — SEO-friendly read-only mirror of prometheus.x.
|
|
#
|
|
# Prometheus's real home is the BCNR name `prometheus.x`, served from this
|
|
# VPS via the name's `ip`+`tls` records. Search engines can't resolve `.x`,
|
|
# so this subdomain exists specifically to be crawled: it reverse-proxies to
|
|
# the same service and the response's `rel=canonical` already names
|
|
# `prometheus.x` as the authoritative URL — Googlebot indexes the content
|
|
# but attributes it to the real address.
|
|
#
|
|
# This is the same practice theseus.x and ariadne.x use via their
|
|
# conventional-DNS mirrors; see [[silentmode-site-url-scheme]] for the
|
|
# family's URL convention.
|
|
#
|
|
# POST endpoints (publish, admin, login) are proxied too — operator admin
|
|
# over https works via this hostname as a backup. For the typical sign-in
|
|
# flow we still prefer prometheus.x directly from Theseus.
|
|
|
|
server {
|
|
listen 443 ssl;
|
|
listen [::]:443 ssl;
|
|
http2 on;
|
|
server_name apps.silentmode.st;
|
|
|
|
# Reuse the main silentmode.st certificate (it covers *.silentmode.st when
|
|
# that SAN is set up). If it isn't, request one and reload angie.
|
|
ssl_certificate /etc/letsencrypt/live/silentmode.st/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/silentmode.st/privkey.pem;
|
|
|
|
# No agent, no cookies lost in transit — we want the proxy to be a thin
|
|
# pipe so what the live service sends is what the crawler reads.
|
|
location / {
|
|
proxy_pass http://127.0.0.1:3700;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
proxy_set_header X-Forwarded-Host apps.silentmode.st;
|
|
|
|
# Matches the service's 200 MiB upload cap. Reads are small; this
|
|
# governs POST /api/upload.
|
|
client_max_body_size 200m;
|
|
proxy_request_buffering off;
|
|
|
|
# The service's own long-cache headers decide for static assets; this
|
|
# proxy does not add any additional caching layer.
|
|
proxy_buffering off;
|
|
proxy_read_timeout 120s;
|
|
}
|
|
|
|
# Deny the admin via the mirror — the operator always goes direct to
|
|
# prometheus.x. Removes one scanner's worth of noise against /admin.
|
|
location ^~ /admin {
|
|
return 404;
|
|
}
|
|
}
|
|
|
|
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
server_name apps.silentmode.st;
|
|
return 301 https://$host$request_uri;
|
|
}
|