lxe/mpm
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MPM marketplace and UI updates

Browse Source
This commit is contained in:
leon
2026-10-08 21:13:57 +02:00
parent 7b121fa908
commit fd9de823ea
66 changed files with 5187 additions and 749 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
docker/nginx/nginx.conf
View File

@@ -62,6 +62,30 @@ http {
}
# Management-API ans Backend proxien
# Modulstarts können durch Docker-Builds deutlich länger als 30 Sekunden dauern.
# Der Client muss auf die Lifecycle-Antwort warten können.
location /api/v1/modules/ {
proxy_pass http://platform_backend;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 600s;
}
# Marketplace-Updates klonen Branches, bauen Images und starten Compose-Stacks.
# Diese Lifecycle-Antworten können länger als das normale API-Limit dauern.
location /api/v1/marketplace/modules/ {
proxy_pass http://platform_backend;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 600s;
}
location /api/ {
proxy_pass http://platform_backend;
proxy_http_version 1.1;
@@ -72,6 +96,27 @@ http {
proxy_read_timeout 30s;
}
# Next.js benötigt Inline-Skripte für die React-Hydrierung. Die globale
# Plattform-CSP ohne 'unsafe-inline' würde trotz geladener JS-Dateien
# alle Client-Handler des Kalendertools blockieren.
location ~ "^/kalendartool(?<calendar_module_path>/.*)?$" {
proxy_pass http://platform_backend/api/v1/gateway/kalendartool$calendar_module_path;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 60s;
proxy_hide_header Content-Security-Policy;
# add_header überschreibt hier die globale Header-Liste; die übrigen
# Sicherheits-Header deshalb erneut setzen.
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'" always;
}
# Modul-Routing (Phase 4): /slug/* wird intern an den
# Modul-Gateway des Backends übergeben (/api/v1/gateway/slug/*).
# Der Gateway prüft Session, Modul-Status und Berechtigung,