mirror of
https://github.com/kernelkit/infix.git
synced 2026-08-03 06:13:02 +02:00
Joachim Wiberg
d53b7f8531
Rename the Maintenance > Backup & Restore page to Backup & Support and add a Support Bundle card. Download support runs the on-device `support collect` tool, which gathers configuration, logs, routing, interfaces, hardware inventory, and container and service status into a single archive; the WebUI runs as root so the collection is complete. The handler buffers the archive and only commits response headers once collection succeeds, so a mid-collection failure is a clean error rather than a truncated download. An optional password encrypts the bundle via the tool's GPG support, fed on stdin so it never reaches the process list. Collection blocks for up to a minute with no output, so the write deadline is extended past the server's 15s WriteTimeout and nginx gets a matching read timeout; the browser shows a "collecting" state and saves the blob client-side using the server's filename. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
64 lines
2.4 KiB
Plaintext
64 lines
2.4 KiB
Plaintext
# Must be at server scope, not on an inner location: client_max_body_size
|
|
# does not inherit into a nested location that declares its own proxy_pass,
|
|
# and the http-level 1m default would silently apply and reject bundle
|
|
# uploads with 413.
|
|
client_max_body_size 256m;
|
|
|
|
location / {
|
|
include /etc/nginx/webui-proxy.conf;
|
|
}
|
|
|
|
# burst=3 nodelay: three POSTs land back-to-back; the next needs a
|
|
# fresh token (~12 s at 5r/m) or 429s.
|
|
location = /login {
|
|
limit_req zone=webui_login burst=3 nodelay;
|
|
include /etc/nginx/webui-proxy.conf;
|
|
}
|
|
|
|
# Keep proxy_request_buffering on (the default). Streaming the body races
|
|
# the Go handler's response close, producing RST instead of FIN at
|
|
# Content-Length and a client-visible 502. nginx spools the body to
|
|
# /var/cache/nginx/client-body during the upload instead.
|
|
location = /software/upload {
|
|
proxy_read_timeout 600s;
|
|
include /etc/nginx/webui-proxy.conf;
|
|
}
|
|
|
|
# SSE progress stream: RAUC's Progress D-Bus property doesn't change while
|
|
# it's writing a slot, so the upstream goes minutes without a frame. The
|
|
# default 60 s proxy_read_timeout closes the stream and the browser sees
|
|
# a transient error. Raise to cover a slow image write end-to-end.
|
|
location = /software/progress {
|
|
proxy_read_timeout 1800s;
|
|
proxy_buffering off;
|
|
include /etc/nginx/webui-proxy.conf;
|
|
}
|
|
|
|
# SSE live-tail stream for Maintenance > Logs. Same buffering / timeout
|
|
# concerns as the software progress stream: nginx must not buffer the
|
|
# event frames, and the connection has to stay open through quiet logs.
|
|
# The Go side sends a 15 s heartbeat, so 600 s of read timeout is plenty
|
|
# of safety margin.
|
|
location ~ ^/maintenance/logs/[^/]+/tail$ {
|
|
proxy_read_timeout 600s;
|
|
proxy_buffering off;
|
|
include /etc/nginx/webui-proxy.conf;
|
|
}
|
|
|
|
# Support bundle collection runs `support collect`, which emits nothing
|
|
# until it finishes (~50 s) and then sends the whole archive at once.
|
|
# The upstream is silent for that window, so the default 60 s
|
|
# proxy_read_timeout would 504 just as the bundle is ready. Buffering
|
|
# stays on — it's a plain file download, not a stream.
|
|
location = /maintenance/support-bundle {
|
|
proxy_read_timeout 300s;
|
|
include /etc/nginx/webui-proxy.conf;
|
|
}
|
|
|
|
# Liveness probe — nginx-only, no upstream call. Used by the watchdog
|
|
# div in base.html and the reboot-overlay poller.
|
|
location = /device-status {
|
|
access_log off;
|
|
return 204;
|
|
}
|