mirror of
https://github.com/zulip/zulip.git
synced 2025-11-10 00:46:03 +00:00
02ae71f27f
As part of our effort to change the data model away from each user having a single API key, we're eliminating the couple requests that were made from Django to Tornado (as part of a /register or home request) where we used the user's API key grabbed from the database for authentication. Instead, we use the (already existing) internal_notify_view authentication mechanism, which uses the SHARED_SECRET setting for security, for these requests, and just fetch the user object using get_user_profile_by_id directly. Tweaked by Yago to include the new /api/v1/events/internal endpoint in the exempt_patterns list in test_helpers, since it's an endpoint we call through Tornado. Also added a couple missing return type annotations.
90 lines
2.4 KiB
Plaintext
90 lines
2.4 KiB
Plaintext
upstream staging {
|
|
server staging0.zulipchat.net:443;
|
|
|
|
keepalive 10000;
|
|
}
|
|
|
|
upstream prod {
|
|
server prod0.zulipchat.net:443;
|
|
|
|
keepalive 10000;
|
|
}
|
|
|
|
server {
|
|
listen 80;
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
|
|
server {
|
|
# The listen needs to be `www.zulipstaging.com` since bare zulipstaging.com
|
|
# is not a CNAME and thus has the public IP inside EC2
|
|
listen www.zulipstaging.com:443;
|
|
server_name zulipstaging.com *.zulipstaging.com;
|
|
|
|
ssl on;
|
|
ssl_certificate /etc/ssl/certs/wildcard-zulipstaging.com.combined-chain.crt;
|
|
ssl_certificate_key /etc/ssl/private/wildcard-zulipstaging.com.key;
|
|
|
|
location / {
|
|
proxy_pass https://staging/;
|
|
include /etc/nginx/zulip-include/proxy;
|
|
}
|
|
|
|
location /sockjs {
|
|
proxy_pass https://staging;
|
|
include /etc/nginx/zulip-include/location-sockjs;
|
|
}
|
|
|
|
# We don't need /api/v1/events/internal, because that doesn't go through the loadbalancer.
|
|
location ~ /json/events|/api/v1/events {
|
|
proxy_pass https://staging;
|
|
include /etc/nginx/zulip-include/proxy_longpolling;
|
|
}
|
|
|
|
include /etc/nginx/zulip-include/certbot;
|
|
}
|
|
|
|
server {
|
|
# The listen needs to be `www.zulipchat.com` since bare zulipchat.com
|
|
# is not a CNAME and thus has the public IP inside EC2
|
|
listen www.zulipchat.com:443 default_server;
|
|
server_name zulipchat.com *.zulipchat.com;
|
|
|
|
ssl on;
|
|
ssl_certificate /etc/ssl/certs/wildcard-zulipchat.com.combined-chain.crt;
|
|
ssl_certificate_key /etc/ssl/private/wildcard-zulipchat.com.key;
|
|
|
|
location / {
|
|
proxy_pass https://prod;
|
|
include /etc/nginx/zulip-include/proxy;
|
|
}
|
|
|
|
location /sockjs {
|
|
proxy_pass https://prod;
|
|
include /etc/nginx/zulip-include/location-sockjs;
|
|
}
|
|
|
|
location ~ /json/events|/api/v1/events {
|
|
proxy_pass https://prod;
|
|
include /etc/nginx/zulip-include/proxy_longpolling;
|
|
}
|
|
|
|
include /etc/nginx/zulip-include/certbot;
|
|
}
|
|
|
|
server {
|
|
listen uploads.zulipusercontent.net:443;
|
|
server_name uploads.zulipusercontent.net;
|
|
|
|
ssl on;
|
|
ssl_certificate /etc/letsencrypt/live/uploads.zulipusercontent.net/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/uploads.zulipusercontent.net/privkey.pem;
|
|
|
|
location / {
|
|
proxy_pass http://127.0.0.1:9292;
|
|
include /etc/nginx/zulip-include/proxy;
|
|
}
|
|
|
|
include /etc/nginx/zulip-include/certbot;
|
|
}
|