mirror of
https://github.com/MarekWo/mc-webui.git
synced 2026-10-30 23:51:57 +01:00
MarekWoandClaude Opus 5
05ec5fa13e
Adds an opt-in HTTPS layer without touching anything for existing installs. The proxy is a service in docker-compose.yml behind the "https" Compose profile, activated with COMPOSE_PROFILES=https in .env. That keeps the whole setup inside files git owns while the switch lives in a file it ignores -- important because scripts/update.sh runs `git pull`, so any user edit to a tracked compose file would break the next update with a merge conflict. mcupdate needs no change: compose reads COMPOSE_PROFILES from .env itself. Both services share the project's default network, so the proxy forwards to http://mc-webui:5000 internally; MC_BIND_ADDRESS lets the plain-HTTP port be restricted to loopback once HTTPS works, and MC_TRUST_PROXY turns on ProxyFix so the app sees the real client address and scheme. Also fixes copying over plain HTTP. navigator.clipboard only exists in a secure context, and 9 call sites across 5 entry points used it with no fallback, so copy buttons silently did nothing on a LAN address. They now share clipboard-utils.js, loaded via _head_i18n.html (the one include every entry point already has), which falls back to execCommand. Verified locally against the real stack: self-signed cert uploaded to NPM, proxy host created, app served over HTTPS with socket.io upgrading to a real wss:// WebSocket (transport "websocket"), and the clipboard fallback checked end-to-end by pasting back what it copied over http://. Two findings from that run are documented in docs/https-setup.md: NPM 2.15 dropped the default admin@example.com account for a setup wizard, and its default 443 server now refuses connections without SNI -- which is every connection made to a bare IP address. docker/npm-default-site.conf is the opt-in way around that, mounted writable (a :ro mount aborts s6 init and leaves nginx not listening at all). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
41 lines
1.6 KiB
Plaintext
41 lines
1.6 KiB
Plaintext
# Replacement for Nginx Proxy Manager's built-in /etc/nginx/conf.d/default.conf.
|
|
#
|
|
# Only needed to reach mc-webui by bare IP address over HTTPS — see the
|
|
# "Browsing by IP address" section of docs/https-setup.md. Not used unless you
|
|
# mount it yourself; the stock file is fine for every hostname-based setup.
|
|
#
|
|
# Why: browsers do not send SNI when you type an IP address, so nginx falls back
|
|
# to the default server for port 443. Since 2.15 that default is a block ending in
|
|
# `ssl_reject_handshake on;`, which refuses the connection outright. This copy of
|
|
# the file keeps the port 80 fallback and drops that 443 block, so the first (or
|
|
# only) proxy host becomes the default and answers with its own certificate —
|
|
# the behaviour older releases had.
|
|
#
|
|
# Mount it WITHOUT :ro — the container chowns its config at startup, and on a read-only
|
|
# mount that failure aborts s6 init, leaving nginx not listening at all.
|
|
#
|
|
# This shadows a file that ships inside the image. If a future Nginx Proxy Manager
|
|
# release changes it, this copy keeps winning: unmount it to go back to stock.
|
|
|
|
# "You are not configured" page, which is the default if another default doesn't exist
|
|
server {
|
|
listen 80;
|
|
#listen [::]:80;
|
|
|
|
set $forward_scheme "http";
|
|
set $server "127.0.0.1";
|
|
set $port "80";
|
|
|
|
server_name localhost-nginx-proxy-manager;
|
|
access_log /data/logs/fallback_http_access.log standard;
|
|
error_log /data/logs/fallback_http_error.log warn;
|
|
include conf.d/include/assets.conf;
|
|
include conf.d/include/block-exploits.conf;
|
|
include conf.d/include/letsencrypt-acme-challenge.conf;
|
|
|
|
location / {
|
|
index index.html;
|
|
root /var/www/html;
|
|
}
|
|
}
|