AI: nginx refuses /internal/ and /metrics case-insensitively (#36)

OP OpenVibers committed 10 Oct 2026 · c37a3eb8cd · 1 file, +1 −1

nginx config only. Express routes case-insensitively, so a case variant such as `/Internal/events` or `/METRICS` slipped past the case-sensitive `location /internal/ { return 404; }` and `location = /metrics { return 404; }` blocks and reached the app. Those paths were still guarded in the app (the Events signature, the loopback check on metrics). Both blocks are now `location ~* ^/internal(/|$)` and `location ~* ^/metrics(/|$)`. The independent security reviews of 2026-10-09/10 found this in several services; this applies it network-wide.

Changes

ddiff --git a/deploy/nginx/ai.openvibe.services.conf b/deploy/nginx/ai.openvibe.services.conf
iindex 9f2508d..3185cd9 100644
---- a/deploy/nginx/ai.openvibe.services.conf
++++ b/deploy/nginx/ai.openvibe.services.conf
@@@ -59,7 +59,7 @@ server {
      location = /api/ready  { proxy_pass http://127.0.0.1:4700; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header CF-Connecting-IP $remote_addr; }
  
      # Metrics are for host-local scrapers only (http://127.0.0.1:4700/metrics).
--    location = /metrics { return 404; }
++    location ~* ^/metrics(/|$) { return 404; }
  
      # ── Developer apps (ai.app.run): the six direct operations and a run read ──
      location ~ ^/api/v1/(chat|generate|summarize|classify|extract|embed)$ {