Revision of bookwrym-cf.md

brennan revised this gist 1 month ago. Go to revision

1 file changed, 7 insertions, 6 deletions

bookwrym-cf.md

			@@ -17,15 +17,15 @@ Cloudflare → cloudflared → nginx:80 → /static/ served directly
17	17		→ everything else → Gunicorn
18	18		```
19	19
20		-	## 1. Disable SSL in nginx
	20	+	## 1. Switch nginx to reverse proxy mode
21	21
22		-	Set `NGINX_SETUP=http` in your `.env`:
	22	+	Set `NGINX_SETUP=reverse_proxy` in your `.env`:
23	23
24	24		```
25		-	NGINX_SETUP=http
	25	+	NGINX_SETUP=reverse_proxy
26	26		```
27	27
28		-	This switches the built-in nginx to plain HTTP mode. Cloudflare handles HTTPS so yr server only needs to speak plain HTTP internally. certbot will do nothing.
	28	+	BookWyrm's nginx directory includes a `reverse_proxy.conf` specifically for setups where TLS is handled upstream. This makes nginx listen on port 80 only, with no SSL or certbot. (`NGINX_SETUP=http` does not work because there is no `http.conf` in the repo.)
29	29
30	30		## 2. Point your Cloudflare tunnel at nginx, not Gunicorn
31	31
			@@ -50,7 +50,8 @@ USE_HTTPS=true
50	50
51	51		## 4. Apply the changes
52	52
	53	+	You must do a full `down` + `up`, not just `up -d`. If Docker can't find the config file when the container first starts, it creates a directory at that path instead, and nginx falls back to its default welcome page. A full restart clears that:
	54	+
53	55		```bash
54		-	docker compose up -d
55		-	```
	56	+	docker compose down && docker compose up -d
56	57		```

brennan revised this gist 1 month ago. Go to revision

1 file changed, 22 insertions, 59 deletions

bookwrym-cf.md

			@@ -1,93 +1,56 @@
1		-	# BookWyrm + Cloudflare Tunnel
	1	+	# BookWyrm + Cloudflare Tunnel (updated)
2	2
3		-	The problem is still that your tunnel is pointing directly at Gunicorn, which doesn't serve static files. It returns HTML for every `/static/` request, and the browser blocks it due to MIME type mismatch.
	3	+	If your Cloudflare tunnel points directly at Gunicorn (`web:8000`), nginx is bypassed entirely. Gunicorn returns HTML for every `/static/` request, and the browser blocks it due to MIME type mismatch and that's why there's no CSS.
4	4
5		-	The fix is to add a small nginx container that sits between the tunnel and Gunicorn. nginx serves `/static/` and `/images/` straight from the Docker volumes, and passes everything else to Gunicorn.
	5	+	The fix is to point the tunnel at nginx instead, and disable certbot since Cloudflare handles TLS.
6	6
7		-	## How the traffic flows (i think)
	7	+	## How the traffic flows
8	8
9		-	Without the fix:
	9	+	Without the fix (tunnel bypasses nginx):
10	10		```
11		-	Cloudflare → cloudflared → bookwyrm-web:8000 (Gunicorn) ✗
	11	+	Cloudflare → cloudflared → web:8000 (Gunicorn) ✗
12	12		```
13	13
14	14		With the fix:
15	15		```
16		-	Cloudflare → cloudflared → bookwyrm-nginx:80 → /static/ served directly
17		-	→ everything else → Gunicorn
	16	+	Cloudflare → cloudflared → nginx:80 → /static/ served directly
	17	+	→ everything else → Gunicorn
18	18		```
19	19
20		-	## 1. Add the nginx config
	20	+	## 1. Disable SSL in nginx
21	21
22		-	Create nginx-books/nginx.conf next to your docker-compose.yml:
	22	+	Set `NGINX_SETUP=http` in your `.env`:
23	23
24		-	```nginx
25		-	upstream bookwyrm {
26		-	server bookwyrm-web:8000;
27		-	}
28		-
29		-	server {
30		-	listen 80;
31		-	client_max_body_size 10M;
32		-
33		-	location /static/ {
34		-	alias /app/static/;
35		-	}
36		-
37		-	location /images/ {
38		-	alias /app/images/;
39		-	}
40		-
41		-	location / {
42		-	proxy_pass http://bookwyrm;
43		-	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
44		-	proxy_set_header Host $host;
45		-	proxy_set_header X-Forwarded-Proto https;
46		-	proxy_redirect off;
47		-	}
48		-	}
49	24		```
50		-
51		-	## 2. Add the nginx service to docker-compose.yml
52		-
53		-	```yaml
54		-	bookwyrm-nginx:
55		-	image: nginx:alpine
56		-	restart: unless-stopped
57		-	depends_on:
58		-	- bookwyrm-web
59		-	volumes:
60		-	- ./nginx-books/nginx.conf:/etc/nginx/conf.d/default.conf:ro
61		-	- bookwyrm_static:/app/static:ro
62		-	- bookwyrm_media:/app/images:ro
	25	+	NGINX_SETUP=http
63	26		```
64	27
65		-	Make sure it's on the same Docker network as your other BookWyrm containers.
	28	+	This switches the built-in nginx to plain HTTP mode. Cloudflare handles HTTPS so yr server only needs to speak plain HTTP internally. certbot will do nothing.
66	29
67		-	## 3. Update your Cloudflare Tunnel to point at nginx
	30	+	## 2. Point your Cloudflare tunnel at nginx, not Gunicorn
68	31
69		-	In your `cloudflared` config (`config.yml`), change the BookWyrm hostname to route to nginx instead of Gunicorn:
	32	+	In your `cloudflared` config (`config.yml`):
70	33
71	34		```yaml
72	35		ingress:
73	36		- hostname: books.yourdomain.com
74		-	service: http://bookwyrm-nginx:80 # was bookwyrm-web:8000
	37	+	service: http://nginx:80 # not web:8000
75	38		- service: http_status:404
76	39		```
77	40
78		-	If you manage your tunnel through the Cloudflare dashboard instead of a config file, go to Zero Trust → Networks → Tunnels, edit the tunnel, and change the service URL to `http://bookwyrm-nginx:80`.
	41	+	If you manage your tunnel through the Cloudflare dashboard, go to Zero Trust → Networks → Tunnels, edit the tunnel, and set the service URL to `http://nginx:80`.
79	42
80		-	## 4. Keep USE_HTTPS set to true
	43	+	## 3. Keep USE_HTTPS set to true
81	44
82		-	Even though TLS is handled by Cloudflare and yr server only speaks plain HTTP internally, BookWyrm still needs to know it's behind HTTPS so it generates correct `https://` URLs:
	45	+	Even though the server speaks plain HTTP internally, BookWyrm still needs to know it's behind HTTPS so it generates correct `https://` URLs:
83	46
84		-	```yaml
85		-	environment:
86		-	USE_HTTPS: "true"
	47	+	```
	48	+	USE_HTTPS=true
87	49		```
88	50
89		-	## 5. Apply the changes
	51	+	## 4. Apply the changes
90	52
91	53		```bash
92	54		docker compose up -d
	55	+	```
93	56		```

brennan revised this gist 1 month ago. Go to revision

1 file changed, 93 insertions

bookwrym-cf.md(file created)

		@@ -0,0 +1,93 @@
1	+	# BookWyrm + Cloudflare Tunnel
2	+
3	+	The problem is still that your tunnel is pointing directly at Gunicorn, which doesn't serve static files. It returns HTML for every `/static/` request, and the browser blocks it due to MIME type mismatch.
4	+
5	+	The fix is to add a small nginx container that sits between the tunnel and Gunicorn. nginx serves `/static/` and `/images/` straight from the Docker volumes, and passes everything else to Gunicorn.
6	+
7	+	## How the traffic flows (i think)
8	+
9	+	Without the fix:
10	+	```
11	+	Cloudflare → cloudflared → bookwyrm-web:8000 (Gunicorn) ✗
12	+	```
13	+
14	+	With the fix:
15	+	```
16	+	Cloudflare → cloudflared → bookwyrm-nginx:80 → /static/ served directly
17	+	→ everything else → Gunicorn
18	+	```
19	+
20	+	## 1. Add the nginx config
21	+
22	+	Create nginx-books/nginx.conf next to your docker-compose.yml:
23	+
24	+	```nginx
25	+	upstream bookwyrm {
26	+	server bookwyrm-web:8000;
27	+	}
28	+
29	+	server {
30	+	listen 80;
31	+	client_max_body_size 10M;
32	+
33	+	location /static/ {
34	+	alias /app/static/;
35	+	}
36	+
37	+	location /images/ {
38	+	alias /app/images/;
39	+	}
40	+
41	+	location / {
42	+	proxy_pass http://bookwyrm;
43	+	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
44	+	proxy_set_header Host $host;
45	+	proxy_set_header X-Forwarded-Proto https;
46	+	proxy_redirect off;
47	+	}
48	+	}
49	+	```
50	+
51	+	## 2. Add the nginx service to docker-compose.yml
52	+
53	+	```yaml
54	+	bookwyrm-nginx:
55	+	image: nginx:alpine
56	+	restart: unless-stopped
57	+	depends_on:
58	+	- bookwyrm-web
59	+	volumes:
60	+	- ./nginx-books/nginx.conf:/etc/nginx/conf.d/default.conf:ro
61	+	- bookwyrm_static:/app/static:ro
62	+	- bookwyrm_media:/app/images:ro
63	+	```
64	+
65	+	Make sure it's on the same Docker network as your other BookWyrm containers.
66	+
67	+	## 3. Update your Cloudflare Tunnel to point at nginx
68	+
69	+	In your `cloudflared` config (`config.yml`), change the BookWyrm hostname to route to nginx instead of Gunicorn:
70	+
71	+	```yaml
72	+	ingress:
73	+	- hostname: books.yourdomain.com
74	+	service: http://bookwyrm-nginx:80 # was bookwyrm-web:8000
75	+	- service: http_status:404
76	+	```
77	+
78	+	If you manage your tunnel through the Cloudflare dashboard instead of a config file, go to Zero Trust → Networks → Tunnels, edit the tunnel, and change the service URL to `http://bookwyrm-nginx:80`.
79	+
80	+	## 4. Keep USE_HTTPS set to true
81	+
82	+	Even though TLS is handled by Cloudflare and yr server only speaks plain HTTP internally, BookWyrm still needs to know it's behind HTTPS so it generates correct `https://` URLs:
83	+
84	+	```yaml
85	+	environment:
86	+	USE_HTTPS: "true"
87	+	```
88	+
89	+	## 5. Apply the changes
90	+
91	+	```bash
92	+	docker compose up -d
93	+	```

Newer Older