Skip to content

README.md

Latest commit

 

History

History
53 lines (39 loc) · 1.72 KB

README.md

File metadata and controls

53 lines (39 loc) · 1.72 KB

Repo-Managed Nginx

This directory contains the Dockerized Nginx edge for Undefined Meet.

Structure

  • Dockerfile: builds web/dist and packages it into the Nginx image
  • nginx.conf: base Nginx configuration
  • entrypoint.sh: derives domains from env vars and renders templates
  • templates/*.template: vhosts for the app, Jitsi, whiteboard, and default host

Configuration

  • App host is derived from WEB_PUBLIC_URL
  • Jitsi host is derived from WEB_JITSI_DOMAIN
  • Whiteboard host is derived from WHITEBOARD_COLLAB_SERVER_PUBLIC_URL
  • TLS paths are provided via:
    • NGINX_TLS_CERT_PATH
    • NGINX_TLS_KEY_PATH
    • NGINX_TLS_OPTIONS_PATH
    • NGINX_TLS_DHPARAM_PATH
  • Optional runtime vars:
    • SERVER_PORT defaults to 4062
    • NGINX_RELOAD_INTERVAL_SECONDS defaults to 21600
    • CERTBOT_RENEW_INTERVAL_SECONDS defaults to 43200

The container fails fast if required Nginx env vars are missing.

Security

  • Safe to commit: templates, Docker Compose wiring, and placeholder env names
  • Do not commit: real .env values, TLS private keys, certificate archives, OAuth secrets, JWT secrets, or service passwords
  • Certificate material must be mounted at runtime, typically from /etc/letsencrypt
  • Public exposure is limited to Nginx (80, 443) and JVB media UDP; server and whiteboard stay internal-only

Validation

docker compose config
docker compose build nginx
docker compose run --rm nginx nginx -t

Production

docker-compose.prod.yml contains production-only overrides:

  • host certificate mounts for nginx and certbot
  • server runtime hardening (read_only, tmpfs, dropped capabilities)
docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d --build