openvibers/openvibe.watch Commits

nginx: close the resource index on the public vhost (^~ prefix) (#29)

OP OpenVibers committed 10 Oct 2026 · 39f73f23a3 · 1 file, +2 −1

Watch#28 closed `/api/v1/resources` on the public vhost with a regex location, but the later `location ^~ /api/v1/` stops nginx from checking regexes for anything under that prefix, so the request still reached the app (403 from its guard, verified on production). A longer `^~ /api/v1/resources` prefix wins over it. OpenVibe.Services keeps reading the index on 127.0.0.1:4730.

Changes

ddiff --git a/deploy/nginx/openvibe.watch.conf b/deploy/nginx/openvibe.watch.conf
iindex c991150..6b1ffee 100644
---- a/deploy/nginx/openvibe.watch.conf
++++ b/deploy/nginx/openvibe.watch.conf
@@@ -103,7 +103,8 @@ server {
      # /Metrics and friends are refused the same way.
      location ~* ^/metrics(/|$) { return 404; }
      # OpenVibe.Services reads the resource index on loopback (127.0.0.1:4730) with a service token.
--    location ~* ^/api/v1/resources(/|$) { return 404; }
++    # A ^~ prefix: the `^~ /api/v1/` block below stops regex matching, so a regex here would never run.
++    location ^~ /api/v1/resources { return 404; }
  
      # ── Sign-in: the network's own budget. /auth/me is the navbar's session probe and gets the
      #    page budget instead, because it runs on every page view. ──