509 lines
14 KiB
Plaintext
509 lines
14 KiB
Plaintext
proxmox11.yiem.cc {
|
|
reverse_proxy 192.168.88.11:8006 {
|
|
transport http {
|
|
tls_insecure_skip_verify
|
|
}
|
|
}
|
|
}
|
|
|
|
proxmox12.yiem.cc {
|
|
reverse_proxy 192.168.88.12:8006 {
|
|
transport http {
|
|
tls_insecure_skip_verify
|
|
}
|
|
}
|
|
}
|
|
|
|
proxmox13.yiem.cc {
|
|
reverse_proxy 192.168.88.13:8006 {
|
|
transport http {
|
|
tls_insecure_skip_verify
|
|
}
|
|
}
|
|
}
|
|
|
|
proxmox14.yiem.cc {
|
|
reverse_proxy 192.168.88.14:8006 {
|
|
transport http {
|
|
tls_insecure_skip_verify
|
|
}
|
|
}
|
|
}
|
|
|
|
proxmox20.yiem.cc {
|
|
reverse_proxy 192.168.88.20:8006 {
|
|
transport http {
|
|
tls_insecure_skip_verify
|
|
}
|
|
}
|
|
}
|
|
|
|
proxmox21.yiem.cc {
|
|
reverse_proxy 192.168.88.21:8006 {
|
|
transport http {
|
|
tls_insecure_skip_verify
|
|
}
|
|
}
|
|
}
|
|
|
|
git.yiem.cc {
|
|
reverse_proxy 192.168.88.110:3000
|
|
}
|
|
|
|
drone.yiem.cc {
|
|
reverse_proxy 192.168.88.110:81
|
|
}
|
|
|
|
registry.yiem.cc {
|
|
route {
|
|
basic_auth {
|
|
cicd $2a$14$JPVuqNDC/Hss3cNMORiN7ubIG19wd2BEQTKuzQKet33uLVSMlsw0q
|
|
}
|
|
reverse_proxy 192.168.88.110:5000
|
|
}
|
|
}
|
|
|
|
argocd.yiem.cc {
|
|
reverse_proxy 192.168.88.200:80
|
|
}
|
|
|
|
mqtt.yiem.cc:8083/mqtt {
|
|
reverse_proxy localhost:9083
|
|
}
|
|
|
|
mqtt.yiem.cc:8084 {
|
|
reverse_proxy localhost:9084
|
|
}
|
|
|
|
llmembedding.yiem.cc {
|
|
reverse_proxy 192.168.88.50:9010
|
|
}
|
|
|
|
llmcoder.yiem.cc {
|
|
reverse_proxy 192.168.88.50:9001
|
|
}
|
|
|
|
llmcoder2.yiem.cc {
|
|
reverse_proxy 10.8.0.2:9001
|
|
}
|
|
|
|
nats.yiem.cc {
|
|
reverse_proxy localhost:4222
|
|
}
|
|
|
|
natsws.yiem.cc {
|
|
reverse_proxy localhost:9222 {
|
|
header_up Host {http.request.host}
|
|
header_up X-Forwarded-For {http.request.remote}
|
|
header_up X-Forwarded-Proto {http.request.scheme}
|
|
}
|
|
}
|
|
|
|
yiem.cc, www.yiem.cc {
|
|
reverse_proxy 192.168.88.109:10001
|
|
}
|
|
|
|
erp.yiem.cc {
|
|
reverse_proxy 192.168.88.107:8080
|
|
}
|
|
|
|
api.yiem.cc {
|
|
reverse_proxy 192.168.88.102:11434
|
|
}
|
|
|
|
fileserver.yiem.cc {
|
|
# 1. Handle OPTIONS preflight requests specifically
|
|
@options {
|
|
method OPTIONS
|
|
}
|
|
respond @options 204
|
|
|
|
# 2. Add CORS headers to all responses (including those from the proxy)
|
|
header {
|
|
Access-Control-Allow-Origin "*"
|
|
Access-Control-Allow-Methods "GET, HEAD, OPTIONS, POST, PUT, DELETE"
|
|
Access-Control-Allow-Headers "*"
|
|
Access-Control-Max-Age "86400"
|
|
}
|
|
|
|
# 3. Proxy to your Plik server
|
|
reverse_proxy 192.168.88.104:8080 {
|
|
header_up Host {http.request.host}
|
|
header_up X-Forwarded-For {http.request.remote}
|
|
header_up X-Forwarded-Proto {http.request.scheme}
|
|
}
|
|
}
|
|
|
|
# 1. Garage Web Admin UI
|
|
garage-ui.yiem.cc {
|
|
reverse_proxy 192.168.88.106:3909
|
|
}
|
|
|
|
# 2. Garage S3 API (Path-Style & Single Domain)
|
|
s3-api.yiem.cc {
|
|
reverse_proxy 192.168.88.106:3900
|
|
}
|
|
|
|
# 3. Garage S3 WEB (Path-Style & Single Domain)
|
|
s3-web.yiem.cc {
|
|
# /bucket -> /bucket/
|
|
@bucket_root path_regexp bucket_root ^/([^/]+)$
|
|
redir @bucket_root /{http.regexp.bucket_root.1}/ 301
|
|
|
|
# /bucket/... -> Garage
|
|
@bucket path_regexp bucket ^/([^/]+)(/.*)?$
|
|
|
|
rewrite @bucket {http.regexp.bucket.2}
|
|
|
|
reverse_proxy 192.168.88.106:3902 {
|
|
header_up Host {http.regexp.bucket.1}.s3-web.yiem.cc
|
|
}
|
|
}
|
|
|
|
|
|
tonmedia.yiem.cc {
|
|
reverse_proxy 192.168.88.104:8096
|
|
}
|
|
|
|
https://office.yiem.cc:443 {
|
|
reverse_proxy 192.168.88.101:11000
|
|
}
|
|
|
|
https://officeproject.yiem.cc {
|
|
reverse_proxy 192.168.88.101:10003
|
|
}
|
|
|
|
tech.yiem.cc {
|
|
reverse_proxy 192.168.88.109:11001
|
|
}
|
|
|
|
smartfarm.yiem.cc {
|
|
reverse_proxy 192.168.88.109:11050
|
|
}
|
|
|
|
testsite1.yiem.cc {
|
|
reverse_proxy 192.168.88.109:11111
|
|
}
|
|
|
|
wine.yiem.cc {
|
|
reverse_proxy /hq/agent/sommelier/frontend/user* 192.168.88.109:10208
|
|
reverse_proxy /hq/agent/sommelier/frontend/dbadmin* 192.168.88.109:10209
|
|
reverse_proxy /hq/agent/sommelier/frontend/retaileradmin* 192.168.88.109:10207
|
|
reverse_proxy 192.168.88.109:13001
|
|
}
|
|
|
|
blossom.yiem.cc {
|
|
reverse_proxy 192.168.88.109:14001
|
|
}
|
|
|
|
play.yiem.cc {
|
|
reverse_proxy 192.168.88.105:12000
|
|
}
|
|
|
|
app1.yiem.cc {
|
|
# Preserve common upstream headers for all proxied requests
|
|
@all {
|
|
path_regexp all ^/.*$
|
|
}
|
|
|
|
# -------------------------
|
|
# service-a QA: canonicalize and proxy
|
|
# -------------------------
|
|
|
|
# Redirect exact no-trailing-slash QA path to canonical trailing-slash
|
|
@a_qaNoSlash path /service-a-qa
|
|
redir @a_qaNoSlash https://app1.yiem.cc/service-a-qa/ 301
|
|
|
|
# Match any QA path (covers /service-a-qa, /service-a-qa/, and subpaths)
|
|
@a_qa path_regexp qa ^/service-a-qa(/.*|$)
|
|
|
|
# Proxy QA traffic to ingress LB and inject X-Forwarded-Prefix
|
|
reverse_proxy @a_qa 192.168.88.200:80 {
|
|
header_up X-Forwarded-Prefix /service-a-qa
|
|
header_up Host {http.request.host}
|
|
header_up X-Real-IP {http.request.remote}
|
|
# Optional: tune timeouts or health checks here if needed
|
|
}
|
|
|
|
# -----------------------------
|
|
# service-a Production: canonicalize and proxy
|
|
# -----------------------------
|
|
|
|
# Redirect exact no-trailing-slash prod path to canonical trailing-slash
|
|
@a_prodNoSlash path /service-a
|
|
redir @a_prodNoSlash https://app1.yiem.cc/service-a/ 301
|
|
|
|
# Match any production path (covers /service-a, /service-a/, and subpaths)
|
|
@a_prod path_regexp prod ^/service-a(/.*|$)
|
|
|
|
# Proxy production traffic to ingress LB; X-Forwarded-Prefix not required if ingress rewrites
|
|
reverse_proxy @a_prod 192.168.88.200:80 {
|
|
header_up Host {http.request.host}
|
|
header_up X-Real-IP {http.request.remote}
|
|
}
|
|
|
|
# -------------------------
|
|
# service-b QA: canonicalize and proxy
|
|
# -------------------------
|
|
|
|
# Redirect exact no-trailing-slash QA path to canonical trailing-slash
|
|
@b_qaNoSlash path /service-b-qa
|
|
redir @b_qaNoSlash https://app1.yiem.cc/service-b-qa/ 301
|
|
|
|
# Match any QA path (covers /service-b-qa, /service-b-qa/, and subpaths)
|
|
@b_qa path_regexp qa ^/service-b-qa(/.*|$)
|
|
|
|
# Proxy QA traffic to ingress LB
|
|
reverse_proxy @b_qa 192.168.88.200:80 {
|
|
header_up Host {http.request.host}
|
|
header_up X-Real-IP {http.request.remote}
|
|
# Optional: tune timeouts or health checks here if needed
|
|
}
|
|
|
|
# -----------------------------
|
|
# service-b Production: canonicalize and proxy
|
|
# -----------------------------
|
|
|
|
# Redirect exact no-trailing-slash prod path to canonical trailing-slash
|
|
@b_prodNoSlash path /service-b
|
|
redir @b_prodNoSlash https://app1.yiem.cc/service-b/ 301
|
|
|
|
# Match any production path (covers /service-b, /service-b/, and subpaths)
|
|
@b_prod path_regexp prod ^/service-b(/.*|$)
|
|
|
|
# Proxy production traffic to ingress LB; X-Forwarded-Prefix not required if ingress rewrites
|
|
reverse_proxy @b_prod 192.168.88.200:80 {
|
|
header_up Host {http.request.host}
|
|
header_up X-Real-IP {http.request.remote}
|
|
}
|
|
|
|
# -------------------------
|
|
# Fallback: forward other requests to the ingress
|
|
# -------------------------
|
|
reverse_proxy 192.168.88.200:80 {
|
|
header_up Host {http.request.host}
|
|
header_up X-Real-IP {http.request.remote}
|
|
}
|
|
}
|
|
|
|
# =============================
|
|
# app2.yiem.cc: Reverse Proxy Configuration
|
|
# =============================
|
|
app2.yiem.cc {
|
|
# Preserve common upstream headers for all proxied requests
|
|
@all {
|
|
path_regexp all ^/.*$
|
|
}
|
|
|
|
# -------------------------
|
|
# service-a QA: canonicalize and proxy
|
|
# -------------------------
|
|
|
|
# Redirect exact no-trailing-slash QA path to canonical trailing-slash
|
|
@a_qaNoSlash path /service-a-qa
|
|
redir @a_qaNoSlash https://app2.yiem.cc/service-a-qa/ 301
|
|
|
|
# Match any QA path (covers /service-a-qa, /service-a-qa/, and subpaths)
|
|
@a_qa path_regexp qa ^/service-a-qa(/.*|$)
|
|
|
|
# Proxy QA traffic to ingress LB and inject X-Forwarded-Prefix
|
|
reverse_proxy @a_qa 192.168.88.200:80 {
|
|
header_up X-Forwarded-Prefix /service-a-qa
|
|
header_up Host {http.request.host}
|
|
header_up X-Real-IP {http.request.remote}
|
|
# Optional: tune timeouts or health checks here if needed
|
|
}
|
|
|
|
# -----------------------------
|
|
# service-a Production: canonicalize and proxy
|
|
# -----------------------------
|
|
|
|
# Redirect exact no-trailing-slash prod path to canonical trailing-slash
|
|
@a_prodNoSlash path /service-a
|
|
redir @a_prodNoSlash https://app2.yiem.cc/service-a/ 301
|
|
|
|
# Match any production path (covers /service-a, /service-a/, and subpaths)
|
|
@a_prod path_regexp prod ^/service-a(/.*|$)
|
|
|
|
# Proxy production traffic to ingress LB; X-Forwarded-Prefix not required if ingress rewrites
|
|
reverse_proxy @a_prod 192.168.88.200:80 {
|
|
header_up Host {http.request.host}
|
|
header_up X-Real-IP {http.request.remote}
|
|
}
|
|
|
|
# -------------------------
|
|
# service-b QA: canonicalize and proxy
|
|
# -------------------------
|
|
|
|
# Redirect exact no-trailing-slash QA path to canonical trailing-slash
|
|
@b_qaNoSlash path /service-b-qa
|
|
redir @b_qaNoSlash https://app2.yiem.cc/service-b-qa/ 301
|
|
|
|
# Match any QA path (covers /service-b-qa, /service-b-qa/, and subpaths)
|
|
@b_qa path_regexp qa ^/service-b-qa(/.*|$)
|
|
|
|
# Proxy QA traffic to ingress LB
|
|
reverse_proxy @b_qa 192.168.88.200:80 {
|
|
header_up Host {http.request.host}
|
|
header_up X-Real-IP {http.request.remote}
|
|
# Optional: tune timeouts or health checks here if needed
|
|
}
|
|
|
|
# -----------------------------
|
|
# service-b Production: canonicalize and proxy
|
|
# -----------------------------
|
|
|
|
# Redirect exact no-trailing-slash prod path to canonical trailing-slash
|
|
@b_prodNoSlash path /service-b
|
|
redir @b_prodNoSlash https://app2.yiem.cc/service-b/ 301
|
|
|
|
# Match any production path (covers /service-b, /service-b/, and subpaths)
|
|
@b_prod path_regexp prod ^/service-b(/.*|$)
|
|
|
|
# Proxy production traffic to ingress LB; X-Forwarded-Prefix not required if ingress rewrites
|
|
reverse_proxy @b_prod 192.168.88.200:80 {
|
|
header_up Host {http.request.host}
|
|
header_up X-Real-IP {http.request.remote}
|
|
}
|
|
|
|
# -------------------------
|
|
# Fallback: forward other requests to the ingress
|
|
# -------------------------
|
|
reverse_proxy 192.168.88.200:80 {
|
|
header_up Host {http.request.host}
|
|
header_up X-Real-IP {http.request.remote}
|
|
}
|
|
}
|
|
|
|
sommpanion.yiem.cc {
|
|
# Preserve common upstream headers for all proxied requests
|
|
@all {
|
|
path_regexp all ^/.*$
|
|
}
|
|
|
|
# -------------------------
|
|
# wine-db-admin QA: canonicalize and proxy
|
|
# -------------------------
|
|
|
|
# Redirect exact no-trailing-slash QA path to canonical trailing-slash
|
|
@wine_db_admin_qaNoSlash path /wine-db-admin-qa
|
|
redir @wine_db_admin_qaNoSlash https://sommpanion.yiem.cc/wine-db-admin-qa/ 301
|
|
|
|
# Match any QA path (covers /wine-db-admin-qa, /wine-db-admin-qa/, and subpaths)
|
|
@wine_db_admin_qa path_regexp qa ^/wine-db-admin-qa(/.*|$)
|
|
|
|
# Proxy QA traffic to ingress LB and inject X-Forwarded-Prefix
|
|
reverse_proxy @wine_db_admin_qa 192.168.88.200:80 {
|
|
header_up X-Forwarded-Prefix /wine-db-admin-qa
|
|
header_up Host {http.request.host}
|
|
header_up X-Real-IP {http.request.remote}
|
|
# Optional: tune timeouts or health checks here if needed
|
|
}
|
|
|
|
# -----------------------------
|
|
# wine-db-admin Production: canonicalize and proxy
|
|
# -----------------------------
|
|
|
|
# Redirect exact no-trailing-slash prod path to canonical trailing-slash
|
|
@wine_db_admin_prodNoSlash path /wine-db-admin
|
|
redir @wine_db_admin_prodNoSlash https://sommpanion.yiem.cc/wine-db-admin/ 301
|
|
|
|
# Match any production path (covers /wine-db-admin, /wine-db-admin/, and subpaths)
|
|
@wine_db_admin_prod path_regexp prod ^/wine-db-admin(/.*|$)
|
|
|
|
# Proxy production traffic to ingress LB; X-Forwarded-Prefix not required if ingress rewrites
|
|
reverse_proxy @wine_db_admin_prod 192.168.88.200:80 {
|
|
header_up Host {http.request.host}
|
|
header_up X-Real-IP {http.request.remote}
|
|
}
|
|
|
|
# -------------------------
|
|
# wine-retailer-admin QA: canonicalize and proxy
|
|
# -------------------------
|
|
|
|
# Redirect exact no-trailing-slash QA path to canonical trailing-slash
|
|
@wine_retailer_admin_qaNoSlash path /wine-retailer-admin-qa
|
|
redir @wine_retailer_admin_qaNoSlash https://sommpanion.yiem.cc/wine-retailer-admin-qa/ 301
|
|
|
|
# Match any QA path (covers /wine-retailer-admin-qa, /wine-retailer-admin-qa/, and subpaths)
|
|
@wine_retailer_admin_qa path_regexp qa ^/wine-retailer-admin-qa(/.*|$)
|
|
|
|
# Proxy QA traffic to ingress LB and inject X-Forwarded-Prefix
|
|
reverse_proxy @wine_retailer_admin_qa 192.168.88.200:80 {
|
|
header_up X-Forwarded-Prefix /wine-retailer-admin-qa
|
|
header_up Host {http.request.host}
|
|
header_up X-Real-IP {http.request.remote}
|
|
# Optional: tune timeouts or health checks here if needed
|
|
}
|
|
|
|
# -----------------------------
|
|
# wine-retailer-admin Production: canonicalize and proxy
|
|
# -----------------------------
|
|
|
|
# Redirect exact no-trailing-slash prod path to canonical trailing-slash
|
|
@wine_retailer_admin_prodNoSlash path /wine-retailer-admin
|
|
redir @wine_retailer_admin_prodNoSlash https://sommpanion.yiem.cc/wine-retailer-admin/ 301
|
|
|
|
# Match any production path (covers /wine-retailer-admin, /wine-retailer-admin/, and subpaths)
|
|
@wine_retailer_admin_prod path_regexp prod ^/wine-retailer-admin(/.*|$)
|
|
|
|
# Proxy production traffic to ingress LB; X-Forwarded-Prefix not required if ingress rewrites
|
|
reverse_proxy @wine_retailer_admin_prod 192.168.88.200:80 {
|
|
header_up Host {http.request.host}
|
|
header_up X-Real-IP {http.request.remote}
|
|
}
|
|
|
|
|
|
# -------------------------
|
|
# agent-frontend QA: canonicalize and proxy
|
|
# -------------------------
|
|
|
|
# Redirect exact no-trailing-slash QA path to canonical trailing-slash
|
|
@agent_frontend_qaNoSlash path /agent-frontend-qa
|
|
redir @agent_frontend_qaNoSlash https://sommpanion.yiem.cc/agent-frontend-qa/ 301
|
|
|
|
# Match any QA path (covers /agent-frontend-qa, /agent-frontend-qa/, and subpaths)
|
|
@agent_frontend_qa path_regexp qa ^/agent-frontend-qa(/.*|$)
|
|
|
|
# Proxy QA traffic to ingress LB and inject X-Forwarded-Prefix
|
|
reverse_proxy @agent_frontend_qa 192.168.88.200:80 {
|
|
header_up X-Forwarded-Prefix /agent-frontend-qa
|
|
header_up Host {http.request.host}
|
|
header_up X-Real-IP {http.request.remote}
|
|
# Optional: tune timeouts or health checks here if needed
|
|
}
|
|
|
|
# -----------------------------
|
|
# agent-frontend Production: canonicalize and proxy
|
|
# -----------------------------
|
|
|
|
# Redirect exact no-trailing-slash prod path to canonical trailing-slash
|
|
@agent_frontend_prodNoSlash path /agent-frontend
|
|
redir @agent_frontend_prodNoSlash https://sommpanion.yiem.cc/agent-frontend/ 301
|
|
|
|
# Match any production path (covers /agent-frontend, /agent-frontend/, and subpaths)
|
|
@agent_frontend_prod path_regexp prod ^/agent-frontend(/.*|$)
|
|
|
|
# Proxy production traffic to ingress LB; X-Forwarded-Prefix not required if ingress rewrites
|
|
reverse_proxy @agent_frontend_prod 192.168.88.200:80 {
|
|
header_up Host {http.request.host}
|
|
header_up X-Real-IP {http.request.remote}
|
|
}
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|