From 686d1749e9415d5bcf0c1ac84706e805c03e7a9c Mon Sep 17 00:00:00 2001 From: einhornimmond Date: Wed, 21 May 2025 15:27:51 +0200 Subject: [PATCH 01/57] add caching rules, tell client caching for 1 year, but no caching for index.html --- .../sites-available/gradido.conf.ssl.template | 16 ++++++++++++++++ .../nginx/sites-available/gradido.conf.template | 16 ++++++++++++++++ 2 files changed, 32 insertions(+) diff --git a/deployment/bare_metal/nginx/sites-available/gradido.conf.ssl.template b/deployment/bare_metal/nginx/sites-available/gradido.conf.ssl.template index 294e9f8a0..40d93ad9a 100644 --- a/deployment/bare_metal/nginx/sites-available/gradido.conf.ssl.template +++ b/deployment/bare_metal/nginx/sites-available/gradido.conf.ssl.template @@ -51,6 +51,12 @@ server { rewrite ^/vue/?(.*)$ /$1 permanent; } + # caching rules for assets + location ~* \.(?:js|css|woff2?|ttf|otf|eot|jpg|jpeg|png|gif|svg|webp|ico)$ { + add_header Cache-Control "public, max-age=31536000, immutable"; + try_files $uri =404; + } + # Frontend (default) location / { @@ -59,6 +65,11 @@ server { root $PROJECT_ROOT/frontend/build/; index index.html; try_files $uri $uri/ /index.html = 404; + + # don't cache index.html + add_header Cache-Control "no-cache, no-store, must-revalidate"; + add_header Pragma "no-cache"; + add_header Expires 0; access_log $GRADIDO_LOG_PATH/nginx-access.frontend.log gradido_log; error_log $GRADIDO_LOG_PATH/nginx-error.frontend.log warn; @@ -119,6 +130,11 @@ server { index index.html; try_files $uri $uri/ /index.html = 404; + # don't cache index.html + add_header Cache-Control "no-cache, no-store, must-revalidate"; + add_header Pragma "no-cache"; + add_header Expires 0; + access_log $GRADIDO_LOG_PATH/nginx-access.admin.log gradido_log; error_log $GRADIDO_LOG_PATH/nginx-error.admin.log warn; } diff --git a/deployment/bare_metal/nginx/sites-available/gradido.conf.template b/deployment/bare_metal/nginx/sites-available/gradido.conf.template index 7bd28b228..ef63c42a4 100644 --- a/deployment/bare_metal/nginx/sites-available/gradido.conf.template +++ b/deployment/bare_metal/nginx/sites-available/gradido.conf.template @@ -36,6 +36,12 @@ server { rewrite ^/vue/?(.*)$ /$1 permanent; } + # caching rules for assets + location ~* \.(?:js|css|woff2?|ttf|otf|eot|jpg|jpeg|png|gif|svg|webp|ico)$ { + add_header Cache-Control "public, max-age=31536000, immutable"; + try_files $uri =404; + } + # Frontend (default) location / { #limit_req zone=frontend burst=40 nodelay; @@ -44,6 +50,11 @@ server { index index.html; try_files $uri $uri/ /index.html = 404; + # don't cache index.html + add_header Cache-Control "no-cache, no-store, must-revalidate"; + add_header Pragma "no-cache"; + add_header Expires 0; + access_log $GRADIDO_LOG_PATH/nginx-access.frontend.log gradido_log; error_log $GRADIDO_LOG_PATH/nginx-error.frontend.log warn; } @@ -103,6 +114,11 @@ server { index index.html; try_files $uri $uri/ /index.html = 404; + # don't cache index.html + add_header Cache-Control "no-cache, no-store, must-revalidate"; + add_header Pragma "no-cache"; + add_header Expires 0; + access_log $GRADIDO_LOG_PATH/nginx-access.admin.log gradido_log; error_log $GRADIDO_LOG_PATH/nginx-error.admin.log warn; } From 830deb9b44f261f290ee8248517ae0d885e32006 Mon Sep 17 00:00:00 2001 From: einhornimmond Date: Wed, 21 May 2025 16:07:17 +0200 Subject: [PATCH 02/57] adjust request limits, log requests limits --- .../nginx/common/limit_requests.conf | 4 +-- .../bare_metal/nginx/conf.d/logging.conf | 4 ++- .../gradido-federation.conf.template | 4 +-- .../sites-available/gradido.conf.ssl.template | 35 +++++++++++-------- .../sites-available/gradido.conf.template | 34 +++++++++++------- 5 files changed, 49 insertions(+), 32 deletions(-) diff --git a/deployment/bare_metal/nginx/common/limit_requests.conf b/deployment/bare_metal/nginx/common/limit_requests.conf index c9501fd64..022a6d3a3 100644 --- a/deployment/bare_metal/nginx/common/limit_requests.conf +++ b/deployment/bare_metal/nginx/common/limit_requests.conf @@ -1,4 +1,4 @@ -limit_req_zone $binary_remote_addr zone=frontend:20m rate=5r/s; -limit_req_zone $binary_remote_addr zone=backend:25m rate=15r/s; +limit_req_zone $binary_remote_addr zone=frontend:20m rate=15r/s; +limit_req_zone $binary_remote_addr zone=backend:25m rate=20r/s; limit_req_zone $binary_remote_addr zone=api:5m rate=30r/s; limit_conn_zone $binary_remote_addr zone=addr:10m; \ No newline at end of file diff --git a/deployment/bare_metal/nginx/conf.d/logging.conf b/deployment/bare_metal/nginx/conf.d/logging.conf index a76e8fae7..b8ed225a8 100644 --- a/deployment/bare_metal/nginx/conf.d/logging.conf +++ b/deployment/bare_metal/nginx/conf.d/logging.conf @@ -1,4 +1,6 @@ log_format gradido_log '$remote_addr - $remote_user [$time_local] ' '"$request_method $status $request_uri"' ' "$http_referer" "$http_user_agent"' - ' $server_protocol $body_bytes_sent $request_time'; \ No newline at end of file + ' $server_protocol $body_bytes_sent $request_time' + ' limit status: $limit_req_status' + ; \ No newline at end of file diff --git a/deployment/bare_metal/nginx/sites-available/gradido-federation.conf.template b/deployment/bare_metal/nginx/sites-available/gradido-federation.conf.template index cf5f53b25..5123deb5e 100644 --- a/deployment/bare_metal/nginx/sites-available/gradido-federation.conf.template +++ b/deployment/bare_metal/nginx/sites-available/gradido-federation.conf.template @@ -1,7 +1,7 @@ location /api/$FEDERATION_APIVERSION { - #limit_req zone=api burst=60 nodelay; - #limit_conn addr 30; + limit_req zone=api burst=60 nodelay; + limit_conn addr 30; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; diff --git a/deployment/bare_metal/nginx/sites-available/gradido.conf.ssl.template b/deployment/bare_metal/nginx/sites-available/gradido.conf.ssl.template index 40d93ad9a..c0791f169 100644 --- a/deployment/bare_metal/nginx/sites-available/gradido.conf.ssl.template +++ b/deployment/bare_metal/nginx/sites-available/gradido.conf.ssl.template @@ -25,8 +25,9 @@ server { include /etc/nginx/common/protect_add_header.conf; # protect from slow loris - #client_body_timeout 10s; - #client_header_timeout 10s; + client_body_timeout 10s; + client_header_timeout 10s; + send_timeout 10s # protect from range attack (in http header) if ($http_range ~ "d{9,}") { @@ -52,16 +53,22 @@ server { } # caching rules for assets - location ~* \.(?:js|css|woff2?|ttf|otf|eot|jpg|jpeg|png|gif|svg|webp|ico)$ { + # static assets + location ~* \.(?:woff2?|ttf|otf|eot|jpg|jpeg|png|gif|svg|webp|ico)$ { + # keep assets for a week + add_header Cache-Control "public, max-age=604800"; + try_files $uri =404; + } + # hashed assets + location ~* \.(?:js|css|json)$ { add_header Cache-Control "public, max-age=31536000, immutable"; try_files $uri =404; } # Frontend (default) location / { - - #limit_req zone=frontend burst=40 nodelay; - #limit_conn addr 40; + limit_req zone=frontend burst=150 nodelay; + limit_conn addr 60; root $PROJECT_ROOT/frontend/build/; index index.html; try_files $uri $uri/ /index.html = 404; @@ -77,8 +84,8 @@ server { # Backend location /graphql { - #limit_req zone=backend burst=10 nodelay; - #limit_conn addr 10; + limit_req zone=backend burst=40 nodelay; + limit_conn addr 20; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection 'upgrade'; @@ -95,8 +102,8 @@ server { # Backend webhooks location /hook { - #limit_req zone=backend burst=10; - #limit_conn addr 10; + limit_req zone=backend burst=20 nodelay; + limit_conn addr 20; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection 'upgrade'; @@ -113,8 +120,8 @@ server { # Webhook reverse proxy location /hooks/ { - #limit_req zone=backend burst=10; - #limit_conn addr 10; + limit_req zone=backend burst=20 nodelay; + limit_conn addr 20; proxy_pass http://127.0.0.1:9000/hooks/; access_log $GRADIDO_LOG_PATH/nginx-access.hooks.log gradido_log; @@ -123,8 +130,8 @@ server { # Admin Frontend location /admin { - #limit_req zone=frontend burst=30 nodelay; - #limit_conn addr 40; + limit_req zone=frontend burst=30 nodelay; + limit_conn addr 20; rewrite ^/admin/(.*)$ /$1 break; root $PROJECT_ROOT/admin/build/; index index.html; diff --git a/deployment/bare_metal/nginx/sites-available/gradido.conf.template b/deployment/bare_metal/nginx/sites-available/gradido.conf.template index ef63c42a4..68fc2edb0 100644 --- a/deployment/bare_metal/nginx/sites-available/gradido.conf.template +++ b/deployment/bare_metal/nginx/sites-available/gradido.conf.template @@ -10,8 +10,9 @@ server { include /etc/nginx/common/protect_add_header.conf; # protect from slow loris - #client_body_timeout 10s; - #client_header_timeout 10s; + client_body_timeout 10s; + client_header_timeout 10s; + send_timeout 10s # protect from range attack (in http header) if ($http_range ~ "d{9,}") { @@ -37,15 +38,22 @@ server { } # caching rules for assets - location ~* \.(?:js|css|woff2?|ttf|otf|eot|jpg|jpeg|png|gif|svg|webp|ico)$ { + # static assets + location ~* \.(?:woff2?|ttf|otf|eot|jpg|jpeg|png|gif|svg|webp|ico)$ { + # keep assets for a week + add_header Cache-Control "public, max-age=604800"; + try_files $uri =404; + } + # hashed assets + location ~* \.(?:js|css|json)$ { add_header Cache-Control "public, max-age=31536000, immutable"; try_files $uri =404; } # Frontend (default) location / { - #limit_req zone=frontend burst=40 nodelay; - #limit_conn addr 40; + limit_req zone=frontend burst=150 nodelay; + limit_conn addr 60; root $PROJECT_ROOT/frontend/build/; index index.html; try_files $uri $uri/ /index.html = 404; @@ -61,8 +69,8 @@ server { # Backend location /graphql { - #limit_req zone=backend burst=10 nodelay; - #limit_conn addr 10; + limit_req zone=backend burst=40 nodelay; + limit_conn addr 20; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection 'upgrade'; @@ -79,8 +87,8 @@ server { # Backend webhooks location /hook { - #limit_req zone=backend burst=10; - #limit_conn addr 10; + limit_req zone=backend burst=20 nodelay; + limit_conn addr 20; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection 'upgrade'; @@ -97,8 +105,8 @@ server { # Webhook reverse proxy location /hooks/ { - #limit_req zone=backend burst=10; - #limit_conn addr 10; + limit_req zone=backend burst=20 nodelay; + limit_conn addr 20; proxy_pass http://127.0.0.1:9000/hooks/; access_log $GRADIDO_LOG_PATH/nginx-access.hooks.log gradido_log; @@ -107,8 +115,8 @@ server { # Admin Frontend location /admin { - #limit_req zone=frontend burst=30 nodelay; - #limit_conn addr 40; + limit_req zone=frontend burst=30 nodelay; + limit_conn addr 20; rewrite ^/admin/(.*)$ /$1 break; root $PROJECT_ROOT/admin/build/; index index.html; From 3a4a246ca87d6aa29d192b9597f62467a3a2a985 Mon Sep 17 00:00:00 2001 From: einhornimmond Date: Wed, 21 May 2025 16:14:44 +0200 Subject: [PATCH 03/57] add missing ; --- .../bare_metal/nginx/sites-available/gradido.conf.ssl.template | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deployment/bare_metal/nginx/sites-available/gradido.conf.ssl.template b/deployment/bare_metal/nginx/sites-available/gradido.conf.ssl.template index c0791f169..1f27a93f3 100644 --- a/deployment/bare_metal/nginx/sites-available/gradido.conf.ssl.template +++ b/deployment/bare_metal/nginx/sites-available/gradido.conf.ssl.template @@ -27,7 +27,7 @@ server { # protect from slow loris client_body_timeout 10s; client_header_timeout 10s; - send_timeout 10s + send_timeout 10s; # protect from range attack (in http header) if ($http_range ~ "d{9,}") { From c57473cf953c0ab93c9f59249b916da1d7a4ffb8 Mon Sep 17 00:00:00 2001 From: einhornimmond Date: Wed, 21 May 2025 16:17:14 +0200 Subject: [PATCH 04/57] fix bug in deploy script --- deployment/bare_metal/start.sh | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/deployment/bare_metal/start.sh b/deployment/bare_metal/start.sh index 37458b540..a812588ba 100755 --- a/deployment/bare_metal/start.sh +++ b/deployment/bare_metal/start.sh @@ -128,9 +128,8 @@ nginx_restart() { sudo systemctl start nginx } } -nginx_restart ln -sf $SCRIPT_DIR/nginx/sites-available/update-page.conf $SCRIPT_DIR/nginx/sites-enabled/default - +nginx_restart # helper functions log_step() { From 1a423552360699a18a98603b7601c7bff5b15383 Mon Sep 17 00:00:00 2001 From: einhornimmond Date: Wed, 21 May 2025 16:18:02 +0200 Subject: [PATCH 05/57] fix typo --- deployment/bare_metal/start.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deployment/bare_metal/start.sh b/deployment/bare_metal/start.sh index a812588ba..17ec8f42d 100755 --- a/deployment/bare_metal/start.sh +++ b/deployment/bare_metal/start.sh @@ -128,7 +128,7 @@ nginx_restart() { sudo systemctl start nginx } } -ln -sf $SCRIPT_DIR/nginx/sites-available/update-page.conf $SCRIPT_DIR/nginx/sites-enabled/default +ln -s $SCRIPT_DIR/nginx/sites-available/update-page.conf $SCRIPT_DIR/nginx/sites-enabled/default nginx_restart # helper functions From f1870fe2f2a97feff439df19b547723c549d6cb8 Mon Sep 17 00:00:00 2001 From: einhornimmond Date: Wed, 21 May 2025 16:20:48 +0200 Subject: [PATCH 06/57] fix --- deployment/bare_metal/start.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deployment/bare_metal/start.sh b/deployment/bare_metal/start.sh index 17ec8f42d..a812588ba 100755 --- a/deployment/bare_metal/start.sh +++ b/deployment/bare_metal/start.sh @@ -128,7 +128,7 @@ nginx_restart() { sudo systemctl start nginx } } -ln -s $SCRIPT_DIR/nginx/sites-available/update-page.conf $SCRIPT_DIR/nginx/sites-enabled/default +ln -sf $SCRIPT_DIR/nginx/sites-available/update-page.conf $SCRIPT_DIR/nginx/sites-enabled/default nginx_restart # helper functions From cbd7910f8b9077a21f692a121c870601110ed90d Mon Sep 17 00:00:00 2001 From: einhornimmond Date: Wed, 21 May 2025 16:26:10 +0200 Subject: [PATCH 07/57] add logging to new routes --- .../nginx/sites-available/gradido.conf.ssl.template | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/deployment/bare_metal/nginx/sites-available/gradido.conf.ssl.template b/deployment/bare_metal/nginx/sites-available/gradido.conf.ssl.template index 1f27a93f3..864e7343a 100644 --- a/deployment/bare_metal/nginx/sites-available/gradido.conf.ssl.template +++ b/deployment/bare_metal/nginx/sites-available/gradido.conf.ssl.template @@ -58,11 +58,17 @@ server { # keep assets for a week add_header Cache-Control "public, max-age=604800"; try_files $uri =404; + + access_log $GRADIDO_LOG_PATH/nginx-access.frontend.log gradido_log; + error_log $GRADIDO_LOG_PATH/nginx-error.frontend.log warn; } # hashed assets location ~* \.(?:js|css|json)$ { add_header Cache-Control "public, max-age=31536000, immutable"; try_files $uri =404; + + access_log $GRADIDO_LOG_PATH/nginx-access.frontend.log gradido_log; + error_log $GRADIDO_LOG_PATH/nginx-error.frontend.log warn; } # Frontend (default) From 688906a2815fdc7b2df6b5a02a6e59142e5479c2 Mon Sep 17 00:00:00 2001 From: einhornimmond Date: Wed, 21 May 2025 16:34:06 +0200 Subject: [PATCH 08/57] remove wrong line in nginx config --- .../nginx/sites-available/gradido.conf.ssl.template | 10 +--------- .../nginx/sites-available/gradido.conf.template | 2 -- 2 files changed, 1 insertion(+), 11 deletions(-) diff --git a/deployment/bare_metal/nginx/sites-available/gradido.conf.ssl.template b/deployment/bare_metal/nginx/sites-available/gradido.conf.ssl.template index 864e7343a..425abd69a 100644 --- a/deployment/bare_metal/nginx/sites-available/gradido.conf.ssl.template +++ b/deployment/bare_metal/nginx/sites-available/gradido.conf.ssl.template @@ -57,18 +57,10 @@ server { location ~* \.(?:woff2?|ttf|otf|eot|jpg|jpeg|png|gif|svg|webp|ico)$ { # keep assets for a week add_header Cache-Control "public, max-age=604800"; - try_files $uri =404; - - access_log $GRADIDO_LOG_PATH/nginx-access.frontend.log gradido_log; - error_log $GRADIDO_LOG_PATH/nginx-error.frontend.log warn; } # hashed assets location ~* \.(?:js|css|json)$ { add_header Cache-Control "public, max-age=31536000, immutable"; - try_files $uri =404; - - access_log $GRADIDO_LOG_PATH/nginx-access.frontend.log gradido_log; - error_log $GRADIDO_LOG_PATH/nginx-error.frontend.log warn; } # Frontend (default) @@ -77,7 +69,7 @@ server { limit_conn addr 60; root $PROJECT_ROOT/frontend/build/; index index.html; - try_files $uri $uri/ /index.html = 404; + try_files $uri $uri/ /index.html = 404; # don't cache index.html add_header Cache-Control "no-cache, no-store, must-revalidate"; diff --git a/deployment/bare_metal/nginx/sites-available/gradido.conf.template b/deployment/bare_metal/nginx/sites-available/gradido.conf.template index 68fc2edb0..1e46318ee 100644 --- a/deployment/bare_metal/nginx/sites-available/gradido.conf.template +++ b/deployment/bare_metal/nginx/sites-available/gradido.conf.template @@ -42,12 +42,10 @@ server { location ~* \.(?:woff2?|ttf|otf|eot|jpg|jpeg|png|gif|svg|webp|ico)$ { # keep assets for a week add_header Cache-Control "public, max-age=604800"; - try_files $uri =404; } # hashed assets location ~* \.(?:js|css|json)$ { add_header Cache-Control "public, max-age=31536000, immutable"; - try_files $uri =404; } # Frontend (default) From b48d47c5ee40600012636d863932f1c327d8a8d7 Mon Sep 17 00:00:00 2001 From: einhornimmond Date: Wed, 21 May 2025 16:38:26 +0200 Subject: [PATCH 09/57] try with included in frontend location block --- .../sites-available/gradido.conf.ssl.template | 27 ++++++++++--------- .../sites-available/gradido.conf.template | 25 +++++++++-------- 2 files changed, 29 insertions(+), 23 deletions(-) diff --git a/deployment/bare_metal/nginx/sites-available/gradido.conf.ssl.template b/deployment/bare_metal/nginx/sites-available/gradido.conf.ssl.template index 425abd69a..c2fe889b8 100644 --- a/deployment/bare_metal/nginx/sites-available/gradido.conf.ssl.template +++ b/deployment/bare_metal/nginx/sites-available/gradido.conf.ssl.template @@ -52,24 +52,27 @@ server { rewrite ^/vue/?(.*)$ /$1 permanent; } - # caching rules for assets - # static assets - location ~* \.(?:woff2?|ttf|otf|eot|jpg|jpeg|png|gif|svg|webp|ico)$ { - # keep assets for a week - add_header Cache-Control "public, max-age=604800"; - } - # hashed assets - location ~* \.(?:js|css|json)$ { - add_header Cache-Control "public, max-age=31536000, immutable"; - } - # Frontend (default) location / { limit_req zone=frontend burst=150 nodelay; limit_conn addr 60; root $PROJECT_ROOT/frontend/build/; index index.html; - try_files $uri $uri/ /index.html = 404; + + # caching rules for assets + # static assets + location ~* \.(?:woff2?|ttf|otf|eot|jpg|jpeg|png|gif|svg|webp|ico)$ { + # keep assets for a week + add_header Cache-Control "public, max-age=604800"; + try_files $uri =404; + } + # hashed assets + location ~* \.(?:js|css|json)$ { + add_header Cache-Control "public, max-age=31536000, immutable"; + try_files $uri =404; + } + + try_files $uri $uri/ /index.html = 404; # don't cache index.html add_header Cache-Control "no-cache, no-store, must-revalidate"; diff --git a/deployment/bare_metal/nginx/sites-available/gradido.conf.template b/deployment/bare_metal/nginx/sites-available/gradido.conf.template index 1e46318ee..05d5719dd 100644 --- a/deployment/bare_metal/nginx/sites-available/gradido.conf.template +++ b/deployment/bare_metal/nginx/sites-available/gradido.conf.template @@ -37,23 +37,26 @@ server { rewrite ^/vue/?(.*)$ /$1 permanent; } - # caching rules for assets - # static assets - location ~* \.(?:woff2?|ttf|otf|eot|jpg|jpeg|png|gif|svg|webp|ico)$ { - # keep assets for a week - add_header Cache-Control "public, max-age=604800"; - } - # hashed assets - location ~* \.(?:js|css|json)$ { - add_header Cache-Control "public, max-age=31536000, immutable"; - } - # Frontend (default) location / { limit_req zone=frontend burst=150 nodelay; limit_conn addr 60; root $PROJECT_ROOT/frontend/build/; index index.html; + + # caching rules for assets + # static assets + location ~* \.(?:woff2?|ttf|otf|eot|jpg|jpeg|png|gif|svg|webp|ico)$ { + # keep assets for a week + add_header Cache-Control "public, max-age=604800"; + try_files $uri =404; + } + # hashed assets + location ~* \.(?:js|css|json)$ { + add_header Cache-Control "public, max-age=31536000, immutable"; + try_files $uri =404; + } + try_files $uri $uri/ /index.html = 404; # don't cache index.html From 7ca419b3202efc8ab60e9a2e10cc4d644ba2b0fd Mon Sep 17 00:00:00 2001 From: einhornimmond Date: Wed, 21 May 2025 16:42:46 +0200 Subject: [PATCH 10/57] cache admin also --- .../sites-available/gradido.conf.ssl.template | 14 ++++++++++++++ .../nginx/sites-available/gradido.conf.template | 16 +++++++++++++++- 2 files changed, 29 insertions(+), 1 deletion(-) diff --git a/deployment/bare_metal/nginx/sites-available/gradido.conf.ssl.template b/deployment/bare_metal/nginx/sites-available/gradido.conf.ssl.template index c2fe889b8..316f93da5 100644 --- a/deployment/bare_metal/nginx/sites-available/gradido.conf.ssl.template +++ b/deployment/bare_metal/nginx/sites-available/gradido.conf.ssl.template @@ -136,6 +136,20 @@ server { rewrite ^/admin/(.*)$ /$1 break; root $PROJECT_ROOT/admin/build/; index index.html; + + # caching rules for assets + # static assets + location ~* \.(?:woff2?|ttf|otf|eot|jpg|jpeg|png|gif|svg|webp|ico)$ { + # keep assets for a week + add_header Cache-Control "public, max-age=604800"; + try_files $uri =404; + } + # hashed assets + location ~* \.(?:js|css|json)$ { + add_header Cache-Control "public, max-age=31536000, immutable"; + try_files $uri =404; + } + try_files $uri $uri/ /index.html = 404; # don't cache index.html diff --git a/deployment/bare_metal/nginx/sites-available/gradido.conf.template b/deployment/bare_metal/nginx/sites-available/gradido.conf.template index 05d5719dd..9b2331fa2 100644 --- a/deployment/bare_metal/nginx/sites-available/gradido.conf.template +++ b/deployment/bare_metal/nginx/sites-available/gradido.conf.template @@ -56,7 +56,7 @@ server { add_header Cache-Control "public, max-age=31536000, immutable"; try_files $uri =404; } - + try_files $uri $uri/ /index.html = 404; # don't cache index.html @@ -121,6 +121,20 @@ server { rewrite ^/admin/(.*)$ /$1 break; root $PROJECT_ROOT/admin/build/; index index.html; + + # caching rules for assets + # static assets + location ~* \.(?:woff2?|ttf|otf|eot|jpg|jpeg|png|gif|svg|webp|ico)$ { + # keep assets for a week + add_header Cache-Control "public, max-age=604800"; + try_files $uri =404; + } + # hashed assets + location ~* \.(?:js|css|json)$ { + add_header Cache-Control "public, max-age=31536000, immutable"; + try_files $uri =404; + } + try_files $uri $uri/ /index.html = 404; # don't cache index.html From 30e22db650785a5b8ecd2b7ea81a44180d401f1b Mon Sep 17 00:00:00 2001 From: einhornimmond Date: Wed, 21 May 2025 16:57:46 +0200 Subject: [PATCH 11/57] without try files --- .../nginx/sites-available/gradido.conf.ssl.template | 4 ++-- .../bare_metal/nginx/sites-available/gradido.conf.template | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/deployment/bare_metal/nginx/sites-available/gradido.conf.ssl.template b/deployment/bare_metal/nginx/sites-available/gradido.conf.ssl.template index 316f93da5..ebcf6996a 100644 --- a/deployment/bare_metal/nginx/sites-available/gradido.conf.ssl.template +++ b/deployment/bare_metal/nginx/sites-available/gradido.conf.ssl.template @@ -142,12 +142,12 @@ server { location ~* \.(?:woff2?|ttf|otf|eot|jpg|jpeg|png|gif|svg|webp|ico)$ { # keep assets for a week add_header Cache-Control "public, max-age=604800"; - try_files $uri =404; + # try_files $uri =404; } # hashed assets location ~* \.(?:js|css|json)$ { add_header Cache-Control "public, max-age=31536000, immutable"; - try_files $uri =404; + # try_files $uri =404; } try_files $uri $uri/ /index.html = 404; diff --git a/deployment/bare_metal/nginx/sites-available/gradido.conf.template b/deployment/bare_metal/nginx/sites-available/gradido.conf.template index 9b2331fa2..2c9cd2324 100644 --- a/deployment/bare_metal/nginx/sites-available/gradido.conf.template +++ b/deployment/bare_metal/nginx/sites-available/gradido.conf.template @@ -127,12 +127,12 @@ server { location ~* \.(?:woff2?|ttf|otf|eot|jpg|jpeg|png|gif|svg|webp|ico)$ { # keep assets for a week add_header Cache-Control "public, max-age=604800"; - try_files $uri =404; + # try_files $uri =404; } # hashed assets location ~* \.(?:js|css|json)$ { add_header Cache-Control "public, max-age=31536000, immutable"; - try_files $uri =404; + # try_files $uri =404; } try_files $uri $uri/ /index.html = 404; From f65dd5aba2fd96ae592c77277ea2168eb8755511 Mon Sep 17 00:00:00 2001 From: einhornimmond Date: Thu, 22 May 2025 07:01:52 +0200 Subject: [PATCH 12/57] try with alias in admin --- .../nginx/sites-available/gradido.conf.ssl.template | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/deployment/bare_metal/nginx/sites-available/gradido.conf.ssl.template b/deployment/bare_metal/nginx/sites-available/gradido.conf.ssl.template index ebcf6996a..1eb01f09e 100644 --- a/deployment/bare_metal/nginx/sites-available/gradido.conf.ssl.template +++ b/deployment/bare_metal/nginx/sites-available/gradido.conf.ssl.template @@ -133,8 +133,8 @@ server { location /admin { limit_req zone=frontend burst=30 nodelay; limit_conn addr 20; - rewrite ^/admin/(.*)$ /$1 break; - root $PROJECT_ROOT/admin/build/; + #rewrite ^/admin/(.*)$ /$1 break; + alias $PROJECT_ROOT/admin/build/; index index.html; # caching rules for assets @@ -142,12 +142,12 @@ server { location ~* \.(?:woff2?|ttf|otf|eot|jpg|jpeg|png|gif|svg|webp|ico)$ { # keep assets for a week add_header Cache-Control "public, max-age=604800"; - # try_files $uri =404; + try_files $uri =404; } # hashed assets location ~* \.(?:js|css|json)$ { add_header Cache-Control "public, max-age=31536000, immutable"; - # try_files $uri =404; + try_files $uri =404; } try_files $uri $uri/ /index.html = 404; From be8342183c3e16a073cb20c3e4c305e9fa5ccc0a Mon Sep 17 00:00:00 2001 From: einhornimmond Date: Thu, 22 May 2025 08:21:25 +0200 Subject: [PATCH 13/57] fix tty problem with docker --- deployment/bare_metal/start.sh | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) diff --git a/deployment/bare_metal/start.sh b/deployment/bare_metal/start.sh index 62406f7a0..f0457609b 100755 --- a/deployment/bare_metal/start.sh +++ b/deployment/bare_metal/start.sh @@ -101,7 +101,15 @@ TODAY=$(date +"%Y-%m-%d") # Create a new updating.html from the template \cp $SCRIPT_DIR/nginx/update-page/updating.html.template $UPDATE_HTML -# redirect all output of the script to the UPDATE_HTML and also have things on console +# store real console stream in fd 3 +if [ -e /dev/tty ]; then + # on normal systems + exec 3> /dev/tty +else + # on docker + exec 3> /proc/$$/fd/1 +fi +# redirect all output of the script to the UPDATE_HTML # TODO: this might pose a security risk exec > >(tee -a $UPDATE_HTML) 2>&1 @@ -109,9 +117,9 @@ exec > >(tee -a $UPDATE_HTML) 2>&1 echo 'Configuring nginx to serve the update-page' nginx_restart() { sudo /etc/init.d/nginx restart || { - echo -e "\e[33mwarn: nginx restart failed, will try to fix with 'sudo systemctl reset-failed nginx' and 'sudo systemctl start nginx'\e[0m" > /dev/tty + echo -e "\e[33mwarn: nginx restart failed, will try to fix with 'sudo systemctl reset-failed nginx' and 'sudo systemctl start nginx'\e[0m" >&3 sudo systemctl reset-failed nginx - sudo systemctl start nginx + sudo systemctl start nginx || sudo nginx -t } } ln -sf $SCRIPT_DIR/nginx/sites-available/update-page.conf $SCRIPT_DIR/nginx/sites-enabled/default @@ -120,22 +128,22 @@ nginx_restart # helper functions log_step() { local message="$1" - echo -e "\e[34m$message\e[0m" # > /dev/tty # blue in console + echo -e "\e[34m$message\e[0m" >&3 # blue in console echo "

$message

" >> "$UPDATE_HTML" # blue in html } log_error() { local message="$1" - echo -e "\e[31m$message\e[0m" # > /dev/tty # red in console + echo -e "\e[31m$message\e[0m" >&3 # red in console echo "$message" >> "$UPDATE_HTML" # red in html } log_warn() { local message="$1" - echo -e "\e[33m$message\e[0m" # > /dev/tty # orange in console + echo -e "\e[33m$message\e[0m" >&3 # orange in console echo "$message" >> "$UPDATE_HTML" # orange in html } log_success() { local message="$1" - echo -e "\e[32m$message\e[0m" # > /dev/tty # green in console + echo -e "\e[32m$message\e[0m" >&3 # green in console echo "

$message

" >> "$UPDATE_HTML" # green in html } From bd431cd7ea96ff442dd932bb5c3eb48f0a501bee Mon Sep 17 00:00:00 2001 From: einhornimmond Date: Thu, 22 May 2025 08:42:20 +0200 Subject: [PATCH 14/57] fix check which wasn't working in docker started from ci --- deployment/bare_metal/start.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/deployment/bare_metal/start.sh b/deployment/bare_metal/start.sh index f0457609b..bc3a56ad1 100755 --- a/deployment/bare_metal/start.sh +++ b/deployment/bare_metal/start.sh @@ -102,11 +102,11 @@ TODAY=$(date +"%Y-%m-%d") \cp $SCRIPT_DIR/nginx/update-page/updating.html.template $UPDATE_HTML # store real console stream in fd 3 -if [ -e /dev/tty ]; then - # on normal systems +if test -t 1; then + # stdout is a TTY - normal console exec 3> /dev/tty else - # on docker + # stdout is not a TTY - probably Docker or CI exec 3> /proc/$$/fd/1 fi # redirect all output of the script to the UPDATE_HTML From e78f8f897089f9a3fe2235f63b189d5c81b16e1d Mon Sep 17 00:00:00 2001 From: einhornimmond Date: Thu, 22 May 2025 08:50:53 +0200 Subject: [PATCH 15/57] more infos if nginx failed --- deployment/bare_metal/start.sh | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/deployment/bare_metal/start.sh b/deployment/bare_metal/start.sh index bc3a56ad1..8403ce817 100755 --- a/deployment/bare_metal/start.sh +++ b/deployment/bare_metal/start.sh @@ -117,9 +117,12 @@ exec > >(tee -a $UPDATE_HTML) 2>&1 echo 'Configuring nginx to serve the update-page' nginx_restart() { sudo /etc/init.d/nginx restart || { - echo -e "\e[33mwarn: nginx restart failed, will try to fix with 'sudo systemctl reset-failed nginx' and 'sudo systemctl start nginx'\e[0m" >&3 + echo -e "\e[33mwarn: nginx restart failed\e[0m" >&3 + # run nginx -t to show problem but ignore exit code to prevent trap + { sudo nginx -t || true; } >&3 + echo -e "\e[33mwarn: will try to fix with 'sudo systemctl reset-failed nginx' and 'sudo systemctl start nginx'\e[0m" >&3 sudo systemctl reset-failed nginx - sudo systemctl start nginx || sudo nginx -t + sudo systemctl start nginx } } ln -sf $SCRIPT_DIR/nginx/sites-available/update-page.conf $SCRIPT_DIR/nginx/sites-enabled/default From 753b5b9d58ae640cb31bc6510b6469d97b64b07f Mon Sep 17 00:00:00 2001 From: einhornimmond Date: Thu, 22 May 2025 08:56:57 +0200 Subject: [PATCH 16/57] finally find error, fix it --- .../bare_metal/nginx/sites-available/gradido.conf.template | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deployment/bare_metal/nginx/sites-available/gradido.conf.template b/deployment/bare_metal/nginx/sites-available/gradido.conf.template index 2c9cd2324..1f5ca2304 100644 --- a/deployment/bare_metal/nginx/sites-available/gradido.conf.template +++ b/deployment/bare_metal/nginx/sites-available/gradido.conf.template @@ -12,7 +12,7 @@ server { # protect from slow loris client_body_timeout 10s; client_header_timeout 10s; - send_timeout 10s + send_timeout 10s; # protect from range attack (in http header) if ($http_range ~ "d{9,}") { From 289c9bc612487e5529dbda0061d87ad1e25eb6c2 Mon Sep 17 00:00:00 2001 From: einhornimmond Date: Fri, 23 May 2025 18:37:09 +0200 Subject: [PATCH 17/57] fix some thinsg preventing contribution link to work, add debugging for frontend --- .vscode/launch.json | 15 +++++++++++++++ .../LinkInformations/RedeemInformation.vue | 2 +- .../LinkInformations/RedeemLoggedOut.vue | 1 - frontend/src/pages/TransactionLink.vue | 18 +++++++++++++----- frontend/vite.config.mjs | 2 +- 5 files changed, 30 insertions(+), 8 deletions(-) create mode 100644 .vscode/launch.json diff --git a/.vscode/launch.json b/.vscode/launch.json new file mode 100644 index 000000000..faf3cff12 --- /dev/null +++ b/.vscode/launch.json @@ -0,0 +1,15 @@ +{ + // Use IntelliSense to learn about possible attributes. + // Hover to view descriptions of existing attributes. + // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387 + "version": "0.2.0", + "configurations": [ + { + "type": "chrome", + "request": "launch", + "name": "Launch Chrome", + "url": "http://localhost:3000", + "webRoot": "${workspaceFolder}/frontend", + } + ] +} \ No newline at end of file diff --git a/frontend/src/components/LinkInformations/RedeemInformation.vue b/frontend/src/components/LinkInformations/RedeemInformation.vue index c89c7c3e9..c1fc21683 100644 --- a/frontend/src/components/LinkInformations/RedeemInformation.vue +++ b/frontend/src/components/LinkInformations/RedeemInformation.vue @@ -10,7 +10,7 @@ {{ '"' + linkData.senderCommunity.name + '.' + linkData.senderUser.firstName + '"' }} {{ $t('transaction-link.send_you') }} {{ $filters.GDD(linkData.amount) }} -

+

{{ '"' + linkData.senderUser.firstName + '"' }} {{ $t('transaction-link.send_you') }} {{ $filters.GDD(linkData.amount) }}

diff --git a/frontend/src/components/LinkInformations/RedeemLoggedOut.vue b/frontend/src/components/LinkInformations/RedeemLoggedOut.vue index dbec1fe4b..58e64f99a 100644 --- a/frontend/src/components/LinkInformations/RedeemLoggedOut.vue +++ b/frontend/src/components/LinkInformations/RedeemLoggedOut.vue @@ -25,7 +25,6 @@