snapshot of https://github.com/zulip/zulip.git @ 48c69911c7dd4e03b20552eb3bd77ad8151c1357 (2026-09-15)

puppet/zulip/files/nginx/dhparam.pem

@@ -0,0 +1,8 @@
+-----BEGIN DH PARAMETERS-----
+MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
++8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
+87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
+YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
+7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
+ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg==
+-----END DH PARAMETERS-----

puppet/zulip/files/nginx/uwsgi_params

@@ -0,0 +1,25 @@
+uwsgi_param QUERY_STRING    $query_string;
+uwsgi_param REQUEST_METHOD  $request_method;
+uwsgi_param CONTENT_TYPE    $content_type;
+uwsgi_param CONTENT_LENGTH  $content_length;
+uwsgi_param REQUEST_URI     $request_uri;
+uwsgi_param PATH_INFO       $document_uri;
+uwsgi_param DOCUMENT_ROOT   $document_root;
+uwsgi_param SERVER_PROTOCOL $server_protocol;
+uwsgi_param REQUEST_SCHEME  $scheme;
+uwsgi_param HTTPS           $https if_not_empty;
+uwsgi_param REMOTE_ADDR     $trusted_remote_addr;
+uwsgi_param REMOTE_PORT     $remote_port;
+uwsgi_param SERVER_ADDR     $server_addr;
+uwsgi_param SERVER_PORT     $server_port;
+uwsgi_param SERVER_NAME     $server_name;
+uwsgi_param HTTP_X_REAL_IP  $trusted_remote_addr;
+uwsgi_param HTTP_X_FORWARDED_PROTO $trusted_x_forwarded_proto;
+uwsgi_param HTTP_X_FORWARDED_SSL "";
+uwsgi_param HTTP_X_PROXY_MISCONFIGURATION $x_proxy_misconfiguration;
+
+# This value is the default, and is provided for explicitness; it must
+# be longer than the configured 55s "harakiri" timeout in uwsgi
+uwsgi_read_timeout 60s;
+
+uwsgi_pass django;

puppet/zulip/files/nginx/zulip-include-app.d/camo.conf

@@ -0,0 +1,11 @@
+# Proxies /external_content to a local installation of the camo image
+# proxy software.  Because camo serves its metrics at /metrics,
+# explicitly 404 that to external requests.
+location /external_content/metrics {
+    return 404;
+}
+location /external_content {
+    rewrite /external_content/(.*) /$1 break;
+    proxy_pass http://camo;
+    include /etc/nginx/zulip-include/proxy;
+}

puppet/zulip/files/nginx/zulip-include-app.d/external-sso.conf

@@ -0,0 +1,8 @@
+# Use this when you have a server listening on localhost that is serving Zulip
+# with some sort of authentication middleware installed. The proxied-to server
+# should pass REMOTE_USER to /accounts/login/sso/ once it has satisfactorily
+# identified the user.
+location /accounts/login/sso/ {
+    proxy_pass https://localhost_sso;
+    include /etc/nginx/zulip-include/proxy;
+}

puppet/zulip/files/nginx/zulip-include-app.d/keepalive-loadbalancer.conf

@@ -0,0 +1,17 @@
+# This file should be used if the nginx is behind a dedicated
+# loadbalancer.  This allows nginx to be configured for long
+# keep-alive timeouts, to keep connections open to the loadbalancer.
+#
+# All timeouts here should be _longer_ than those on the loadbalancer.
+# This ensures that there cannot be a race condition between nginx
+# deciding to shut down the connection, and the load-balancer sending
+# a request, resulting in a 502 from the loadbalancer.
+#
+# The timeouts on the loadbalancer are assumed to be 20min (1200s) or
+# less; these timeouts are hence for 21min.
+
+keepalive_timeout     1260;
+client_header_timeout 1260;
+client_body_timeout   1260;
+
+keepalive_requests     500;

puppet/zulip/files/nginx/zulip-include-common/api_headers

@@ -0,0 +1,4 @@
+include /etc/nginx/zulip-include/headers;
+add_header Access-Control-Allow-Origin * always;
+add_header Access-Control-Allow-Headers Authorization always;
+add_header Access-Control-Allow-Methods 'GET, POST, DELETE, PUT, PATCH, HEAD' always;

puppet/zulip/files/nginx/zulip-include-common/certbot

@@ -0,0 +1,4 @@
+# Directory needed for certbot --webroot to work.
+location /.well-known/acme-challenge/ {
+    alias /var/lib/zulip/certbot-webroot/.well-known/acme-challenge/;
+}

puppet/zulip/files/nginx/zulip-include-common/headers

@@ -0,0 +1,10 @@
+# Enable HSTS: tell browsers to always use HTTPS
+add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload" always;
+
+# Set X-Frame-Options to deny to prevent clickjacking
+add_header X-Frame-Options DENY always;
+
+add_header X-Content-Type-Options nosniff always;
+
+add_header Referrer-Policy strict-origin-when-cross-origin always;
+add_header Cross-Origin-Opener-Policy same-origin always;

puppet/zulip/files/nginx/zulip-include-common/immutable_headers

@@ -0,0 +1,4 @@
+include /etc/nginx/zulip-include/headers;
+add_header Cache-Control "public, max-age=31536000, immutable";
+add_header Access-Control-Allow-Origin *;
+add_header Timing-Allow-Origin *;

puppet/zulip/files/nginx/zulip-include-common/proxy

@@ -0,0 +1,11 @@
+proxy_http_version 1.1;
+# Clearing the Connection header is required for keepalives from the load balancer
+# http://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive
+proxy_set_header Connection "";
+proxy_set_header Host $host;
+proxy_set_header X-Forwarded-Proto $trusted_x_forwarded_proto;
+proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+proxy_set_header X-Real-Ip $trusted_remote_addr;
+proxy_set_header X-Proxy-Misconfiguration $x_proxy_misconfiguration;
+proxy_next_upstream off;
+proxy_redirect off;

puppet/zulip/files/nginx/zulip-include-common/proxy_longpolling

@@ -0,0 +1,3 @@
+include /etc/nginx/zulip-include/proxy;
+proxy_buffering off;
+proxy_read_timeout 1200;

puppet/zulip/files/nginx/zulip-include-common/tornado_cors_headers

@@ -0,0 +1,4 @@
+include /etc/nginx/zulip-include/headers;
+add_header Access-Control-Allow-Origin * always;
+add_header Access-Control-Allow-Headers Authorization always;
+add_header Access-Control-Allow-Methods 'OPTIONS, GET, DELETE' always;

puppet/zulip/files/nginx/zulip-include-frontend/app

@@ -0,0 +1,165 @@
+access_log /var/log/nginx/access.log combined_with_host_and_time;
+error_log /var/log/nginx/error.log;
+
+include /etc/nginx/zulip-include/headers;
+
+# Serve a custom error page when the app is down
+error_page 502 503 504 /static/webpack-bundles/5xx.html;
+
+# Serve static files directly
+location /local-static {
+    alias /home/zulip/local-static;
+}
+location /static/ {
+    alias /home/zulip/prod-static/;
+    gzip_static on;
+    include /etc/nginx/zulip-include/headers;
+    add_header Access-Control-Allow-Origin *;
+    add_header Timing-Allow-Origin *;
+
+    # Set a nonexistent path, so we just serve the nice Django 404 page.
+    error_page 404 /django_static_404.html;
+
+    # These files are hashed and thus immutable; cache them aggressively.
+    # Django adds 12 hex digits; Webpack adds 20.
+    location ~ '\.[0-9a-f]{12}\.|[./][0-9a-f]{20}\.' {
+        include /etc/nginx/zulip-include/immutable_headers;
+    }
+}
+
+# Canonical URL for the root is /help/.
+location = /help {
+    return 301 /help/;
+}
+
+# Redirect to links without the trailing slash except for root /help/.
+location ~ ^(/help(?:/[^/]+)+)/+$ {
+    return 301 $1$is_args$args;
+}
+
+# Serve help center generated by astro/starlight.
+location /help {
+    alias $help_alias;
+
+    gzip_static on;
+    include /etc/nginx/zulip-include/headers;
+    add_header Access-Control-Allow-Origin *;
+    add_header Timing-Allow-Origin *;
+
+    error_page 404 /404.html;
+    index /index.html;
+    try_files $uri $uri/index.html =404;
+
+    # These files are hashed and thus immutable; cache them aggressively.
+    # https://github.com/Pagefind/pagefind/issues/747#issuecomment-2510564644
+    # https://github.com/withastro/docs/blob/53603ad048e8aedbca1aed77bac8eb00dcada79d/src/content/docs/en/guides/integrations-guide/node.mdx?plain=1#L304
+    location ~ ^/help/(pagefind/.*\.(?:pf_fragment|pf_index|pf_meta)|_astro/.*)$ {
+        include /etc/nginx/zulip-include/immutable_headers;
+    }
+}
+
+# Send longpoll requests to Tornado
+location = /json/events {
+    if ($request_method = 'OPTIONS') {
+        # add_header does not propagate into/out of blocks, so this
+        # include cannot be factored out
+        include /etc/nginx/zulip-include/headers;
+        add_header Allow 'OPTIONS, GET, DELETE' always;
+        return 204;
+    }
+
+    if ($request_method !~ ^(GET|DELETE)$ ) {
+        # add_header does not propagate into/out of blocks, so this
+        # include cannot be factored out
+        include /etc/nginx/zulip-include/headers;
+        add_header Allow 'OPTIONS, GET, DELETE' always;
+        return 405;
+    }
+
+    proxy_pass $tornado_server;
+    include /etc/nginx/zulip-include/proxy_longpolling;
+}
+
+# Send longpoll requests to Tornado
+location = /api/v1/events {
+
+    if ($request_method = 'OPTIONS') {
+        include /etc/nginx/zulip-include/tornado_cors_headers;
+        add_header Allow 'OPTIONS, GET, DELETE' always;
+        return 204;
+    }
+
+    if ($request_method !~ ^(GET|DELETE)$ ) {
+        include /etc/nginx/zulip-include/headers;
+        add_header Allow 'OPTIONS, GET, DELETE' always;
+        return 405;
+    }
+
+    include /etc/nginx/zulip-include/tornado_cors_headers;
+    proxy_pass $tornado_server;
+    include /etc/nginx/zulip-include/proxy_longpolling;
+}
+
+# Handle X-Accel-Redirect from Tornado to Tornado
+location ~ ^/internal/tornado/(\d+)(/.*)$ {
+    internal;
+    proxy_pass http://tornado$1$2$is_args$args;
+    include /etc/nginx/zulip-include/proxy_longpolling;
+}
+
+location /api/v1/tus {
+    include /etc/nginx/zulip-include/api_headers;
+    include /etc/nginx/zulip-include/proxy;
+    # https://github.com/tus/tusd/blob/main/examples/nginx.conf
+    # Disable request body size limits, and stream the request and
+    # response from tusd directly.
+    client_max_body_size    0;
+    proxy_request_buffering off;
+    proxy_buffering         off;
+    proxy_pass              http://tusd;
+}
+
+# Send everything else to Django via uWSGI
+location / {
+    include uwsgi_params;
+}
+
+# These Django routes not under /api are shared between mobile and
+# web, and thus need API headers added.  We can't easily collapse
+# these blocks with the /api block, because regular expressions take
+# priority over paths in nginx's order-of-operations, and we don't
+# want to override the tornado configuration for /api/v1/events.
+location /thumbnail {
+    include /etc/nginx/zulip-include/api_headers;
+
+    include uwsgi_params;
+}
+location /avatar {
+    include /etc/nginx/zulip-include/api_headers;
+
+    include uwsgi_params;
+}
+location /user_uploads {
+    include /etc/nginx/zulip-include/api_headers;
+
+    include uwsgi_params;
+}
+
+location /api/internal/ {
+    # These only need be accessed from localhost
+    allow 127.0.0.1;
+    allow ::1;
+    deny all;
+
+    include /etc/nginx/zulip-include/api_headers;
+    include uwsgi_params;
+}
+
+# Send all API routes not covered above to Django via uWSGI
+location /api/ {
+    include /etc/nginx/zulip-include/api_headers;
+
+    include uwsgi_params;
+}
+
+include /etc/nginx/zulip-include/app.d/*.conf;

puppet/zulip/files/nginx/zulip-include-frontend/uploads-internal.conf

@@ -0,0 +1,88 @@
+# Handle redirects to S3
+location ~ ^/internal/s3/(?<s3_hostname>[^/]+)/(?<s3_path>.*) {
+    internal;
+    include /etc/nginx/zulip-include/headers;
+    add_header Content-Security-Policy "default-src 'none'; media-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self'; object-src 'self'; plugin-types application/pdf;";
+
+    # The components of this path are originally double-URI-escaped
+    # (see zerver/view/upload.py).  "location" matches are on
+    # unescaped values, which fills $s3_path with a properly
+    # single-escaped path to pass to the upstream server.
+    # (see associated commit message for more details)
+    set $download_url https://$s3_hostname/$s3_path;
+    proxy_set_header Host $s3_hostname;
+    proxy_ssl_name $s3_hostname;
+    proxy_ssl_server_name on;
+
+    # Strip off X-amz-cf-id header, which otherwise the request has to
+    # have been signed over, leading to signature mismatches.
+    proxy_set_header x-amz-cf-id "";
+
+    # Strip off any auth request headers which the Zulip client might
+    # have sent, as they will not work for S3, and will report an error due
+    # to the signed auth header we also provide.
+    proxy_set_header Authorization "";
+    proxy_set_header x-amz-security-token "";
+
+    # These headers are only valid if there is a body, but better to
+    # strip them to be safe.
+    proxy_set_header Content-Length "";
+    proxy_set_header Content-Type "";
+    proxy_set_header Content-MD5 "";
+    proxy_set_header x-amz-content-sha256 "";
+    proxy_set_header Expect "";
+
+    # Ensure that we only get _one_ of these response headers: the one
+    # that Django added, not the one from S3.
+    proxy_hide_header Cache-Control;
+    proxy_hide_header Expires;
+    proxy_hide_header Set-Cookie;
+    # We are _leaving_ S3 to provide Content-Type,
+    # Content-Disposition, and Accept-Ranges headers, which are the
+    # three remaining headers which nginx would also pass through from
+    # the first response.  Django explicitly unsets the first, and
+    # does not set the latter two.
+
+    # We slice the content into 5M chunks; this means that the client
+    # doesn't need to wait for nginx to download and cache the full
+    # content if the client just requested a small range (e.g. for
+    # showing a thumbnail of a large video).  5M is chosen to be
+    # enough for videos to be able to thumbnail in one slice, but not
+    # take overly long to retrieve from S3, or cause overwhelming
+    # numbers of cache entries for large files.
+    slice 5m;
+    proxy_set_header Range $slice_range;
+
+    proxy_pass $download_url$is_args$args;
+    proxy_cache uploads;
+    # If the S3 response doesn't contain Cache-Control headers (which
+    # we don't expect it to) then we assume they are valid for a very
+    # long time.  The size of the cache is controlled by
+    # `s3_disk_cache_size` and read frequency, set via
+    # `s3_cache_inactive_time`.
+    proxy_cache_valid 200 206 1y;
+
+    # We only include the requested content-disposition (and range
+    # slice) in the cache key, so that we cache "Content-Disposition:
+    # attachment" separately from the inline version.
+    proxy_cache_key $download_url$s3_disposition_cache_key$slice_range;
+}
+
+# Internal file-serving
+location /internal/local/uploads {
+    internal;
+    include /etc/nginx/zulip-include/headers;
+    add_header Content-Security-Policy "default-src 'none'; media-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self'; object-src 'self'; plugin-types application/pdf;";
+
+    # Django handles setting Content-Type, Content-Disposition, and Cache-Control.
+
+    alias /home/zulip/uploads/files;
+}
+
+location /internal/local/user_avatars {
+    internal;
+    include /etc/nginx/zulip-include/headers;
+    add_header Content-Security-Policy "default-src 'none'; img-src 'self'";
+    include /etc/nginx/zulip-include/uploads.types;
+    alias /home/zulip/uploads/avatars;
+}

puppet/zulip/files/nginx/zulip-include-frontend/uploads.types

@@ -0,0 +1,23 @@
+types {
+    text/plain                            txt;
+
+    application/pdf                       pdf;
+
+    image/gif                             gif;
+    image/jpeg                            jpeg jpg jpe;
+    image/png                             png;
+    image/tiff                            tif tiff;
+    image/webp                            webp;
+
+    video/3gpp                            3gpp 3gp;
+    video/mp4                             mp4;
+    video/mpeg                            mpeg mpg;
+    video/quicktime                       mov;
+    video/webm                            webm;
+    video/x-flv                           flv;
+    video/x-m4v                           m4v;
+    video/x-mng                           mng;
+    video/x-ms-asf                        asx asf;
+    video/x-ms-wmv                        wmv;
+    video/x-msvideo                       avi;
+}

puppet/zulip/files/nginx/zulip-include-frontend/upstreams

@@ -0,0 +1,17 @@
+include /etc/nginx/zulip-include/tornado-upstreams;
+
+upstream django {
+    server unix:/home/zulip/deployments/uwsgi-socket;
+}
+
+upstream localhost_sso {
+    server 127.0.0.1:8888;
+}
+
+upstream camo {
+    server 127.0.0.1:9292;
+}
+
+upstream tusd {
+    server 127.0.0.1:9900;
+}