nginx: open /api/v1/memory/ to people's own tokens (#210)

OP OpenVibers committed 14 days ago · 33e573534a · 1 file, +15 −0

The memory store (#209) answered only on the host. The Node's memory upload and
the Memory page need it from outside; every route is token-guarded in the app (a
person acts only for themselves, a service only searches and suggests). The live
vhost is this file again: it was missing /llms-full.txt.

Changes

ddiff --git a/deploy/nginx/ai.openvibe.services.conf b/deploy/nginx/ai.openvibe.services.conf
iindex 24f0d4b..f1d934f 100644
---- a/deploy/nginx/ai.openvibe.services.conf
++++ b/deploy/nginx/ai.openvibe.services.conf
@@@ -117,6 +117,21 @@ server {
          proxy_set_header X-Forwarded-Proto $scheme;
      }
  
++    # ── OpenVibe Memory (2026-10-30): a person's own token from their Node (`openvibe-node memory upload`) or the
++    #    Memory page. Every route is token-guarded in the app (server/memory/index.js): a person acts only for
++    #    themselves, a service only searches (audited) and suggests. Batches are at most 200 items.
++    location /api/v1/memory/ {
++        proxy_pass http://127.0.0.1:4700;
++        proxy_http_version 1.1;
++        proxy_set_header Host $host;
++        proxy_set_header X-Real-IP $remote_addr;          # client address from $remote_addr only (realip),
++        proxy_set_header X-Forwarded-For $remote_addr;    # never appended to or passed through
++        proxy_set_header CF-Connecting-IP $remote_addr;
++        proxy_set_header X-Forwarded-Proto $scheme;
++        client_max_body_size 2m;
++        proxy_read_timeout 60s;
++    }
++
      # ── Service API: host-local only (see header) ───────────
      location /api/ {
          return 403;