54 lines
2.5 KiB
Plaintext
54 lines
2.5 KiB
Plaintext
# Lab boot HTTP server (nginx). One server on :80 serves BOTH:
|
|
# / -> the OCI release artifacts (UKI fleet-<ver>.efi, etc.), mounted
|
|
# read-only from the image volume at /usr/share/nginx/html
|
|
# /kiosk/ -> reverse-proxied to the kiosk SPA container (serving/kiosk-app),
|
|
# a Svelte spaceship-terminal app. NOT part of the artifact image
|
|
# (that stays FROM-scratch); a separate, independently built image.
|
|
#
|
|
# This nginx uses host networking (firmware must fetch the UKI), so it can't join
|
|
# the kiosk container's bridge network by service name. The kiosk container
|
|
# publishes on 127.0.0.1:8088 (compose), which the host-network nginx reaches
|
|
# over loopback. The trailing slash on proxy_pass strips the /kiosk/ prefix, so
|
|
# the SPA (built with base /kiosk/) gets requests at its own root.
|
|
server {
|
|
listen 80 default_server;
|
|
server_name _;
|
|
|
|
# UKI + release artifacts (firmware fetches /fleet-<ver>.efi from here).
|
|
location / {
|
|
root /usr/share/nginx/html;
|
|
autoindex on;
|
|
}
|
|
|
|
# TPM enrolment broker (docs/tpm-enrolment-design.md) — the ONE unauthenticated,
|
|
# pre-auth endpoint. An empty-NV host POSTs its CSR and polls for the signed
|
|
# cert; the admin approve/deny plane is a SEPARATE mTLS listener and is NOT
|
|
# exposed here. Proxied to the broker (dot1x-bench stack) on loopback; the
|
|
# trailing slash strips /enrol/ so the broker sees /request and /status/{id}.
|
|
location /enrol/ {
|
|
proxy_pass http://127.0.0.1:9090/;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-For $remote_addr;
|
|
proxy_set_header Connection "";
|
|
client_max_body_size 16k; # a CSR is ~1KB — cap abuse
|
|
proxy_read_timeout 30s;
|
|
}
|
|
|
|
# Kiosk SPA. The diskless kiosk (kiosk_url) points at
|
|
# http://boot.fleet.lab/kiosk/ — resolved to this host by the stack's dnsmasq
|
|
# and proxied to the kiosk-app container.
|
|
location /kiosk/ {
|
|
proxy_pass http://127.0.0.1:8088/;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-For $remote_addr;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header Connection ""; # SSE is plain HTTP — no WebSocket upgrade needed
|
|
proxy_buffering off;
|
|
proxy_cache off;
|
|
proxy_read_timeout 1h;
|
|
chunked_transfer_encoding off;
|
|
}
|
|
}
|