Games vhosts: the ACME challenge location, and /internal/ and /metrics never proxied. (#13)

OP OpenVibers committed 7 Oct 2026 · b8496b1f64 · 1 file, +15 −1

Structure verified by reading: braces balance 14/14, every new guard sits after `location = /api/ready` and before the catch-all `location /`, all client-IP headers remain `$remote_addr` only, and ports/WebSocket-upgrade blocks are untouched. No test in `test/` references the conf or its routes, so there is no targeted test file to run — `nginx -t` isn't available here either.

Note: the file has **two** `:443` servers (apex and play), both proxying the same `:8000` process and both already carrying the analogous `location = /api/ready { return 404; }` guard — so I applied the `/internal/` and `/metrics` guards to both, matching that existing convention. Also, the `:80` server's redirect had to move from a server-level `return 301` into `location / { return 301 …; }`, because a server-level `return` runs in the rewrite phase before location lookup and would otherwise make the ACME location unreachable (the sibling vhosts all use the `location /` form).

Changes:
- `deploy/nginx-openvibe-games.conf:19` — added `location /.well-known/acme-challenge/ { root /var/www/certbot; }` in the `:80` server.
- `deploy/nginx-openvibe-games.conf:20` — moved the redirect to `location / { return 301 https://$host$request_uri; }` (target unchanged, so it still preserves the requested host).
- `deploy/nginx-openvibe-games.conf:40` — added `location /internal/ { return 404; }` to the apex `:443` server, before the catch-all.
- `deploy/nginx-openvibe-games.conf:43` — added `location = /metrics { return 404; }` to the apex `:443` server, before the catch-all.
- `deploy/nginx-openvibe-games.conf:77` — added `location /internal/ { return 404; }` to the play `:443` server, before the catch-all.
- `deploy/nginx-openvibe-games.conf:80` — added `location = /metrics { return 404; }` to the play `:443` server, before the catch-all.

Docs: the conf path is **not** documented in `docs/deploy` (no such dir) or the README deploy section (`README.md:134-153` mentions nginx generally and links `deploy/openvibe-games.service`, but never the conf path), so no doc mention was added.

Tests: none cover this file — `grep -rniE 'nginx-openvibe-games|nginx.*conf|acme-challenge|internal/|/metrics|api/ready' test/` returned no matches, so no `ov test` run was warranted. Everything left unchanged (ports, WebSocket upgrade, `$remote_addr`-only client-IP headers) is confirmed by the diff.

Changes

ddiff --git a/deploy/nginx-openvibe-games.conf b/deploy/nginx-openvibe-games.conf
iindex a10f276..f59faa4 100644
---- a/deploy/nginx-openvibe-games.conf
++++ b/deploy/nginx-openvibe-games.conf
@@@ -15,7 +15,9 @@ server {
      listen 80;
      listen [::]:80;
      server_name openvibe.games play.openvibe.games;
--    return 301 https://$host$request_uri;
++
++    location /.well-known/acme-challenge/ { root /var/www/certbot; }
++    location / { return 301 https://$host$request_uri; }
  }
  
  server {
@@@ -34,6 +36,12 @@ server {
          return 404;
      }
  
++    # ── The Events webhook: OpenVibe.Events delivers over loopback, never through the public vhosts ──
++    location /internal/ { return 404; }
++
++    # ── Prometheus metrics: host-local scrapers only (http://127.0.0.1:8000/metrics) ──
++    location = /metrics { return 404; }
++
      location / {
          proxy_pass http://127.0.0.1:8000;
          proxy_http_version 1.1;
@@@ -65,6 +73,12 @@ server {
          return 404;
      }
  
++    # ── The Events webhook: OpenVibe.Events delivers over loopback, never through the public vhosts ──
++    location /internal/ { return 404; }
++
++    # ── Prometheus metrics: host-local scrapers only (http://127.0.0.1:8000/metrics) ──
++    location = /metrics { return 404; }
++
      location / {
          proxy_pass http://127.0.0.1:8000;
          proxy_http_version 1.1;