claude
6ec4378047
nginx: [emerg] pcre2_compile() failed: missing closing parenthesis in
"^/s/(?<sid>[a-f0-9]" で gateway が CrashLoopBackOff になっていた。
location ~ の正規表現に含まれる {10} の { } を nginx 設定パーサーがブロック
区切りと解釈していた。nginx は { } ; を含む正規表現のクォートを必須とするため、
files/gateway.conf.template の該当 location をダブルクォートで囲んだ。
envsubst の置換は ${...} 6 変数のみで {10} に影響しないことを確認済み。
102 lines
3.8 KiB
Plaintext
102 lines
3.8 KiB
Plaintext
# nginx.conf (envsubst テンプレート) — claude-code gateway
|
||
# 受付・認証・WebSocket プロキシの単一入口。read-only rootfs / 非 root で動作する。
|
||
worker_processes auto;
|
||
pid /tmp/nginx/nginx.pid;
|
||
error_log /dev/stderr ${NGINX_ERROR_LEVEL};
|
||
|
||
events { worker_connections 1024; }
|
||
|
||
http {
|
||
include /etc/nginx/mime.types;
|
||
default_type application/octet-stream;
|
||
access_log /dev/stdout;
|
||
|
||
client_body_temp_path /tmp/nginx/body;
|
||
proxy_temp_path /tmp/nginx/proxy;
|
||
fastcgi_temp_path /tmp/nginx/fastcgi;
|
||
uwsgi_temp_path /tmp/nginx/uwsgi;
|
||
scgi_temp_path /tmp/nginx/scgi;
|
||
|
||
sendfile on;
|
||
tcp_nopush on;
|
||
server_tokens off;
|
||
client_max_body_size 25m;
|
||
|
||
map $http_upgrade $connection_upgrade { default upgrade; '' close; }
|
||
|
||
resolver ${NGINX_RESOLVER} valid=10s ipv6=off;
|
||
|
||
server {
|
||
listen ${GATEWAY_PORT};
|
||
listen [::]:${GATEWAY_PORT};
|
||
|
||
add_header X-Content-Type-Options nosniff always;
|
||
add_header X-Frame-Options SAMEORIGIN always;
|
||
add_header Referrer-Policy no-referrer always;
|
||
|
||
# ---- HTTP Basic（auth.mode=basic のときのみ内容を持つ）----
|
||
include /tmp/nginx/auth_basic.conf;
|
||
|
||
location = /healthz {
|
||
auth_basic off;
|
||
proxy_pass http://127.0.0.1:${MANAGER_PORT}/healthz;
|
||
}
|
||
|
||
# ---- auth_request の実体（auth.mode=token|forward）----
|
||
location = /_auth {
|
||
internal;
|
||
proxy_pass_request_body off;
|
||
proxy_set_header Content-Length "";
|
||
proxy_set_header X-Original-URI $request_uri;
|
||
proxy_set_header X-Original-Method $request_method;
|
||
include /tmp/nginx/auth_backend.conf;
|
||
}
|
||
|
||
# ---- 制御プレーン（UI / API）----
|
||
location / {
|
||
include /tmp/nginx/auth_request.conf;
|
||
proxy_pass http://127.0.0.1:${MANAGER_PORT};
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
}
|
||
|
||
# UI とログインは常に到達可能にする（token モードのログイン導線のため）
|
||
location = / { proxy_pass http://127.0.0.1:${MANAGER_PORT}; proxy_set_header Host $host; }
|
||
location = /index.html { proxy_pass http://127.0.0.1:${MANAGER_PORT}; proxy_set_header Host $host; }
|
||
location = /login { proxy_pass http://127.0.0.1:${MANAGER_PORT}; proxy_set_header Host $host; }
|
||
location = /api/config {
|
||
include /tmp/nginx/auth_request.conf;
|
||
proxy_pass http://127.0.0.1:${MANAGER_PORT};
|
||
proxy_set_header Host $host;
|
||
}
|
||
|
||
# ---- セッションへのリバースプロキシ（WebSocket 対応）----
|
||
# 正規表現に { } を含むため location 全体をクォートする（nginx 必須）
|
||
location ~ "^/s/(?<sid>[a-f0-9]{10})(?<rest>/.*)?$" {
|
||
include /tmp/nginx/auth_basic.conf;
|
||
include /tmp/nginx/auth_request.conf;
|
||
error_page 401 = @needlogin;
|
||
|
||
set $rest_path $rest;
|
||
if ($rest_path = "") { set $rest_path /; }
|
||
set $sess_backend "http://claude-sess-$sid.${SESSIONS_NS}.svc.cluster.local:${TTYD_PORT}";
|
||
|
||
proxy_pass $sess_backend$rest_path$is_args$args;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Upgrade $http_upgrade;
|
||
proxy_set_header Connection $connection_upgrade;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_read_timeout 3600s;
|
||
proxy_send_timeout 3600s;
|
||
proxy_buffering off;
|
||
}
|
||
|
||
location @needlogin {
|
||
return 302 /?next=$request_uri;
|
||
}
|
||
}
|
||
}
|