Add OneLab Helm chart, Argo CD Application, and GitOps values for k3s

Made-with: Cursor

gitops/charts/onelab/files/nginx.conf.tpl

@@ -0,0 +1,337 @@
+
+worker_processes 4;
+
+events { worker_connections 1024; }
+
+http {
+  include /etc/nginx/mime.types;
+  
+  client_max_body_size 2m;
+
+  # don't send the nginx version number in error pages and Server header
+  server_tokens off;
+
+  sendfile on;
+
+  upstream website {
+    server website:4000;
+  }
+
+  upstream main {
+    server main:80;
+  }
+
+  upstream api {
+    server api:3000;
+  }
+
+  upstream api-device {
+    server api-device:3000;
+  }
+
+  upstream api-rabbit {
+    server api-rabbit:3000;
+  }
+
+  upstream designer {
+    server designer:80;
+  }
+
+  upstream runner {
+    server runner:80;
+  }
+
+  upstream static {
+    server static:80;
+  }
+
+  upstream websocket-worker {
+    server websocket-worker:3030;
+  }
+
+  # Restore the real client IP from the upstream reverse proxy
+  # Trust all RFC 1918 private ranges (covers any Docker network config)
+  set_real_ip_from  10.0.0.0/8;
+  set_real_ip_from  172.16.0.0/12;
+  set_real_ip_from  192.168.0.0/16;
+  real_ip_header    X-Real-IP;
+
+  limit_req_zone $binary_remote_addr zone=auth:10m rate=1r/s;
+  limit_req_zone $binary_remote_addr zone=website:10m rate=5r/s;
+  limit_req_zone $binary_remote_addr zone=global:10m rate=10r/s;
+
+  # redirect all http traffic to https
+  server {
+    listen 80 default_server;
+{{- if .Values.revproxy.ipv6Listen }}
+    listen [::]:80 default_server;
+{{- end }}
+    server_name localhost;
+
+    gzip on;
+    gzip_vary on;
+    gzip_min_length 10240;
+    gzip_proxied expired no-cache no-store private auth;
+    gzip_types text/plain text/css application/json application/x-javascript application/javascript text/xml application/xml application/xml+rss text/javascript;
+    gzip_disable "MSIE [1-6]\.";
+
+    root /data/;
+
+    location ^~ /lab/ {
+      rewrite ^/lab/(.*?) /app/lab/$1 last;
+    }
+
+    location ^~ /assets/ {
+      location ~* \.(?:css|js|woff|woff2|jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc)$ {
+        expires 1M;
+        access_log off;
+        add_header Cache-Control "public";
+
+        try_files $uri $uri/ /error-404.html =404;
+      }
+      expires -1;
+      add_header 'Cache-Control' 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
+
+      try_files $uri $uri/ /error-404.html =404;
+    }
+
+    location ^~ /static/ {
+      location ~* \.(?:css|js|woff|woff2|jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc)$ {
+        expires 1M;
+        access_log off;
+        add_header Cache-Control "public";
+
+        proxy_pass  http://static;
+        proxy_redirect  off;
+        proxy_set_header  Host $host;
+        proxy_set_header  X-Real-IP $remote_addr;
+        proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header  X-Forwarded-Host $server_name;
+      }
+
+      expires -1;
+      add_header 'Cache-Control' 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
+
+      proxy_pass  http://static;
+      proxy_redirect  off;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+    }
+
+    location ^~ /sitemap.xml {
+      limit_req zone=global burst=10 nodelay;
+
+      proxy_pass  http://api;
+      proxy_redirect  off;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+    }
+
+    location ^~ /robots.txt {
+      limit_req zone=global burst=10 nodelay;
+
+      proxy_pass  http://api;
+      proxy_redirect  off;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+    }
+
+    location ^~ /api/ {
+      limit_req zone=global burst=10 nodelay;
+
+      proxy_pass  http://api;
+      proxy_redirect  off;
+      proxy_set_header  Cookie $http_cookie;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+    }
+
+    location ^~ /api/v1/auth/ {
+      # apply rate limiting
+      limit_req zone=auth burst=5 nodelay;
+  
+      proxy_pass http://api;
+      proxy_redirect  off;
+      proxy_set_header  Cookie $http_cookie;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+    }
+    
+    location ^~ /api/v1/firmwares {
+      limit_req zone=global burst=10 nodelay;
+    
+      client_max_body_size 600M;
+
+      proxy_pass  http://api;
+      proxy_redirect  off;
+      proxy_set_header  Cookie $http_cookie;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+    }
+
+    location ^~ /api/v1/rmq/ {
+      proxy_pass  http://api-rabbit;
+      proxy_redirect  off;
+      proxy_set_header  Cookie $http_cookie;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+    }
+
+    location ^~ /device-api/ {
+      limit_req zone=global burst=10 nodelay;
+      client_max_body_size 600m;
+
+      proxy_pass  http://api-device;
+      proxy_redirect  off;
+      proxy_set_header  Cookie $http_cookie;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+    }
+
+    location ^~ /app/designer/ {
+      location ~* \.(?:css|js|woff|woff2|jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc)$ {
+        expires 1M;
+        access_log off;
+        add_header Cache-Control "public";
+
+        proxy_pass  http://designer;
+        proxy_redirect  off;
+        proxy_set_header  Cookie $http_cookie;
+        proxy_set_header  Host $host;
+        proxy_set_header  X-Real-IP $remote_addr;
+        proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header  X-Forwarded-Host $server_name;
+      }
+
+      expires -1;
+      add_header 'Cache-Control' 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
+
+      proxy_pass  http://designer;
+      proxy_redirect  off;
+      proxy_set_header  Cookie $http_cookie;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+    }
+
+    location ^~ /app/runner/ {
+      location ~* \.(?:css|js|woff|woff2|jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc)$ {
+        expires 1M;
+        access_log off;
+        add_header Cache-Control "public";
+
+        proxy_pass  http://runner;
+        proxy_redirect  off;
+        proxy_set_header  Cookie $http_cookie;
+        proxy_set_header  Host $host;
+        proxy_set_header  X-Real-IP $remote_addr;
+        proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header  X-Forwarded-Host $server_name;
+      }
+      
+      expires -1;
+      add_header 'Cache-Control' 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
+
+      proxy_pass  http://runner;
+      proxy_redirect  off;
+      proxy_set_header  Cookie $http_cookie;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+    }
+
+    location ^~ /ws/ {
+      proxy_pass  http://websocket-worker;
+      proxy_redirect  off;
+      proxy_set_header  Cookie $http_cookie;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+      
+      proxy_set_header Upgrade $http_upgrade;
+      proxy_set_header Connection "upgrade";
+    }
+    
+    location ^~ /app/ {
+      location ~* \.(?:css|js|woff|woff2|jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc)$ {
+        expires 1M;
+        access_log off;
+        add_header Cache-Control "public";
+
+        proxy_pass  http://main;
+        proxy_redirect  off;
+        proxy_set_header  Cookie $http_cookie;
+        proxy_set_header  Host $host;
+        proxy_set_header  X-Real-IP $remote_addr;
+        proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header  X-Forwarded-Host $server_name;
+      }
+      
+      expires -1;
+      add_header 'Cache-Control' 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
+
+      proxy_pass  http://main;
+      proxy_redirect  off;
+      proxy_set_header  Cookie $http_cookie;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+    }
+    
+    # Static assets for website (including /media/ subdirectory)
+     location ~* ^/.+\.(?:css|js|woff|woff2|ttf|eot|jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc)$ {   
+        expires 1M;
+        access_log off;
+        add_header Cache-Control "public";
+
+        proxy_pass  http://website;
+        proxy_redirect  off;
+        proxy_set_header  Cookie $http_cookie;
+        proxy_set_header  Host $host;
+        proxy_set_header  X-Real-IP $remote_addr;
+        proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header  X-Forwarded-Host $server_name;
+    }
+
+    # Website SSR routes (rate limited)
+    location ~ ^/(library(/[^/]+)?|login(/(reset|change))?|signup)?$ {
+      limit_req zone=website burst=10 nodelay;
+
+      expires -1;
+      add_header 'Cache-Control' 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
+
+      proxy_pass  http://website;
+      proxy_redirect  off;
+      proxy_set_header  Cookie $http_cookie;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+    }
+
+    # Catch-all for junk requests
+    location /  {
+      try_files $uri $uri/ /error-404.html =404;
+    }
+  }
+}