cmc/dotfiles
Using GNU Stow to manage my dotfiles.
clone: git clone https://gitbay.org/cmc/dotfiles.git
0c68f866ef5823b23877188c4057a00d913bc115
verified · cmc
author: Christian Cleberg <hello@cleberg.net> · 2026-08-03T05:41:00Z
linux/nginx/etc/nginx/conf.d/piped.conf | 74 +++++++++++++++++++++++++++++++++ linux/nginx/etc/nginx/nginx.conf | 14 ++++++- 2 files changed, 87 insertions(+), 1 deletion(-) new file mode 100644 @@ -0,0 +1,74 @@ +# Piped -- Host-based router on 127.0.0.1:8077 +# +# WHY THIS EXISTS: the Cloudflare tunnel routes all three Piped hostnames to +# localhost:8077 -- +# piped.krz.sh -> :8077 +# pipedapi.krz.sh -> :8077 (should be the backend) +# pipedproxy.krz.sh -> :8077 (should be the media proxy) +# so the API and media-proxy hostnames landed on the frontend and Piped was +# broken. The frontend advertises BACKEND_HOSTNAME=pipedapi.krz.sh to browsers, +# so every API call failed. +# +# The tidier fix is two edits in the Cloudflare dashboard (point pipedapi at +# :8078 and pipedproxy at :8079). This file fixes it server-side instead, and +# is harmless if the dashboard is corrected later -- the tunnel would simply +# reach the containers directly and these blocks would go unused. +# +# Ports: frontend :8076 (moved from :8077), backend :8078, media proxy :8079. +# +# NOTE: custom.d/basic.conf is deliberately NOT included. Its Permissions-Policy +# sets fullscreen=(), which would stop videos going fullscreen. + +# Frontend. default_server so the Tor onion for piped (which targets :8077 with +# a .onion Host header) also lands here. +server { + listen 127.0.0.1:8077 default_server; + server_name piped.krz.sh; + + location / { + proxy_pass http://127.0.0.1:8076; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_http_version 1.1; + } +} + +# Backend API. +server { + listen 127.0.0.1:8077; + server_name pipedapi.krz.sh; + + location / { + proxy_pass http://127.0.0.1:8078; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_http_version 1.1; + # The backend emits its own CORS headers; do not add or override any + # here or the browser will reject the API responses. + proxy_read_timeout 120; + } +} + +# Media proxy. Streams video, so no buffering and generous timeouts. +server { + listen 127.0.0.1:8077; + server_name pipedproxy.krz.sh; + + location / { + proxy_pass http://127.0.0.1:8079; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_http_version 1.1; + + proxy_buffering off; + proxy_request_buffering off; + proxy_read_timeout 300; + proxy_send_timeout 300; + } +} @@ -41,7 +41,19 @@ events { # Default: logs/error.log error # https://nginx.org/en/docs/ngx_core_module.html#error_log # error_log /var/log/nginx/error.log warn; -error_log /dev/null emerg; +# +# emerg-only, to stderr -> systemd captures it into journald, which is RAM-only +# on this host (Storage=volatile), so nothing lands on disk and nothing survives +# a reboot. +# +# This was /dev/null, which discarded the one class of message that says the +# server is broken. That cost real diagnostic time twice on 2026-08-03: a reload +# that silently failed to rebind sockets, and the certbot failures. emerg +# messages are startup/bind/shutdown faults and carry no visitor data, so +# keeping them costs nothing in privacy terms. +# +# Read with: journalctl -u nginx +error_log stderr emerg; # The file storing the process ID of the main process # Default: logs/nginx.pid