mirror of
https://github.com/alexbelgium/hassio-addons.git
synced 2026-08-30 00:33:32 +02:00
ca0f78f10e
* fix(portainer): request identity encoding on the ingress listener Portainer compresses its own responses, so every response reached Home Assistant's ingress relay gzipped and chunked, with no Content-Length. Both relay hops (Supervisor api/ingress.py and Core hassio/ingress.py) only take their buffered path for responses carrying a Content-Length under 4 MB; everything else goes through the streaming path, where an aiohttp error surfaces to the browser as 502 Bad Gateway even though the add-on's own nginx logged a 200. proxy_params.conf already stripped Accept-Encoding, but the location block declares its own proxy_set_header directives, and nginx discards every server-level proxy_set_header once a location sets any of its own (the comment above those lines warns about exactly this). The strip was therefore dead config. The same server block serves both the ingress listener and the direct web UI port, so the strip is scoped through a map on $server_port: ingress gets identity, direct access keeps compression. The map keys on the direct-access port rather than the templated ingress port, so the default stays correct if the ingress port ever changes. Verified with a local nginx against the live Portainer backend: - ingress listener, client sending "Accept-Encoding: gzip, deflate" -> identity, Content-Length: 14203 - direct listener, same request -> Content-Encoding: gzip, chunked - direct listener, no Accept-Encoding -> identity, Content-Length - websocket upgrade through ingress still reaches Portainer (401 auth) - nginx -t passes for both the ssl and non-ssl rendered variants Partial mitigation only: vendor.js (5.7 MB) and main.js (7.0 MB) exceed the 4 MB buffering threshold uncompressed and still stream. This supersedes 2.43.0.1, which disabled nginx's own gzip module rather than the compressor that was actually running. Refs #2766 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(portainer): request identity explicitly on the ingress listener Address review feedback: use "identity" rather than an empty value as the map default. Both were verified to produce identity responses with a Content-Length from Portainer, and both leave direct access on 9099 compressed, but "identity" states the intent explicitly instead of relying on the server's choice when no Accept-Encoding is present. Also reword the changelog entry for readability. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
68 lines
1.9 KiB
Nginx Configuration File
68 lines
1.9 KiB
Nginx Configuration File
# Run nginx in foreground.
|
|
daemon off;
|
|
|
|
# This is run inside Docker.
|
|
user root;
|
|
|
|
# Pid storage location.
|
|
pid /var/run/nginx.pid;
|
|
|
|
# Set number of worker processes.
|
|
worker_processes 1;
|
|
|
|
# Enables the use of JIT for regular expressions to speed-up their processing.
|
|
pcre_jit on;
|
|
|
|
# Write error log to Hass.io add-on log.
|
|
error_log /proc/1/fd/1 error;
|
|
|
|
# Load allowed environment vars
|
|
env HASSIO_TOKEN;
|
|
|
|
# Load dynamic modules.
|
|
include /etc/nginx/modules/*.conf;
|
|
|
|
# Max num of simultaneous connections by a worker process.
|
|
events {
|
|
worker_connections 512;
|
|
}
|
|
|
|
http {
|
|
include /etc/nginx/includes/mime.types;
|
|
|
|
log_format hassio '[$time_local] $status '
|
|
'$http_x_forwarded_for($remote_addr) '
|
|
'$request ($http_user_agent)';
|
|
|
|
access_log /proc/1/fd/1 hassio;
|
|
client_max_body_size 4G;
|
|
default_type application/octet-stream;
|
|
gzip on;
|
|
keepalive_timeout 65;
|
|
sendfile on;
|
|
server_tokens off;
|
|
tcp_nodelay on;
|
|
tcp_nopush on;
|
|
|
|
map $http_upgrade $connection_upgrade {
|
|
default upgrade;
|
|
'' close;
|
|
}
|
|
|
|
# Ingress needs Portainer to answer uncompressed, so the responses carry a
|
|
# Content-Length and stay on the relay's buffered path. Direct access on
|
|
# 9099 does not go through the relay, so it keeps compression.
|
|
# Keyed on the direct-access port rather than the ingress port: the ingress
|
|
# port is templated from the add-on config, so defaulting to identity keeps
|
|
# ingress correct even if that port ever changes.
|
|
map $server_port $upstream_accept_encoding {
|
|
default identity;
|
|
9099 $http_accept_encoding;
|
|
}
|
|
|
|
include /etc/nginx/includes/resolver.conf;
|
|
include /etc/nginx/includes/upstream.conf;
|
|
|
|
include /etc/nginx/servers/*.conf;
|
|
}
|