snapshot of https://github.com/zulip/zulip.git @ 48c69911c7dd4e03b20552eb3bd77ad8151c1357 (2026-09-15)

puppet/zulip/files/nginx/zulip-include-frontend/app

@@ -0,0 +1,165 @@
+access_log /var/log/nginx/access.log combined_with_host_and_time;
+error_log /var/log/nginx/error.log;
+
+include /etc/nginx/zulip-include/headers;
+
+# Serve a custom error page when the app is down
+error_page 502 503 504 /static/webpack-bundles/5xx.html;
+
+# Serve static files directly
+location /local-static {
+    alias /home/zulip/local-static;
+}
+location /static/ {
+    alias /home/zulip/prod-static/;
+    gzip_static on;
+    include /etc/nginx/zulip-include/headers;
+    add_header Access-Control-Allow-Origin *;
+    add_header Timing-Allow-Origin *;
+
+    # Set a nonexistent path, so we just serve the nice Django 404 page.
+    error_page 404 /django_static_404.html;
+
+    # These files are hashed and thus immutable; cache them aggressively.
+    # Django adds 12 hex digits; Webpack adds 20.
+    location ~ '\.[0-9a-f]{12}\.|[./][0-9a-f]{20}\.' {
+        include /etc/nginx/zulip-include/immutable_headers;
+    }
+}
+
+# Canonical URL for the root is /help/.
+location = /help {
+    return 301 /help/;
+}
+
+# Redirect to links without the trailing slash except for root /help/.
+location ~ ^(/help(?:/[^/]+)+)/+$ {
+    return 301 $1$is_args$args;
+}
+
+# Serve help center generated by astro/starlight.
+location /help {
+    alias $help_alias;
+
+    gzip_static on;
+    include /etc/nginx/zulip-include/headers;
+    add_header Access-Control-Allow-Origin *;
+    add_header Timing-Allow-Origin *;
+
+    error_page 404 /404.html;
+    index /index.html;
+    try_files $uri $uri/index.html =404;
+
+    # These files are hashed and thus immutable; cache them aggressively.
+    # https://github.com/Pagefind/pagefind/issues/747#issuecomment-2510564644
+    # https://github.com/withastro/docs/blob/53603ad048e8aedbca1aed77bac8eb00dcada79d/src/content/docs/en/guides/integrations-guide/node.mdx?plain=1#L304
+    location ~ ^/help/(pagefind/.*\.(?:pf_fragment|pf_index|pf_meta)|_astro/.*)$ {
+        include /etc/nginx/zulip-include/immutable_headers;
+    }
+}
+
+# Send longpoll requests to Tornado
+location = /json/events {
+    if ($request_method = 'OPTIONS') {
+        # add_header does not propagate into/out of blocks, so this
+        # include cannot be factored out
+        include /etc/nginx/zulip-include/headers;
+        add_header Allow 'OPTIONS, GET, DELETE' always;
+        return 204;
+    }
+
+    if ($request_method !~ ^(GET|DELETE)$ ) {
+        # add_header does not propagate into/out of blocks, so this
+        # include cannot be factored out
+        include /etc/nginx/zulip-include/headers;
+        add_header Allow 'OPTIONS, GET, DELETE' always;
+        return 405;
+    }
+
+    proxy_pass $tornado_server;
+    include /etc/nginx/zulip-include/proxy_longpolling;
+}
+
+# Send longpoll requests to Tornado
+location = /api/v1/events {
+
+    if ($request_method = 'OPTIONS') {
+        include /etc/nginx/zulip-include/tornado_cors_headers;
+        add_header Allow 'OPTIONS, GET, DELETE' always;
+        return 204;
+    }
+
+    if ($request_method !~ ^(GET|DELETE)$ ) {
+        include /etc/nginx/zulip-include/headers;
+        add_header Allow 'OPTIONS, GET, DELETE' always;
+        return 405;
+    }
+
+    include /etc/nginx/zulip-include/tornado_cors_headers;
+    proxy_pass $tornado_server;
+    include /etc/nginx/zulip-include/proxy_longpolling;
+}
+
+# Handle X-Accel-Redirect from Tornado to Tornado
+location ~ ^/internal/tornado/(\d+)(/.*)$ {
+    internal;
+    proxy_pass http://tornado$1$2$is_args$args;
+    include /etc/nginx/zulip-include/proxy_longpolling;
+}
+
+location /api/v1/tus {
+    include /etc/nginx/zulip-include/api_headers;
+    include /etc/nginx/zulip-include/proxy;
+    # https://github.com/tus/tusd/blob/main/examples/nginx.conf
+    # Disable request body size limits, and stream the request and
+    # response from tusd directly.
+    client_max_body_size    0;
+    proxy_request_buffering off;
+    proxy_buffering         off;
+    proxy_pass              http://tusd;
+}
+
+# Send everything else to Django via uWSGI
+location / {
+    include uwsgi_params;
+}
+
+# These Django routes not under /api are shared between mobile and
+# web, and thus need API headers added.  We can't easily collapse
+# these blocks with the /api block, because regular expressions take
+# priority over paths in nginx's order-of-operations, and we don't
+# want to override the tornado configuration for /api/v1/events.
+location /thumbnail {
+    include /etc/nginx/zulip-include/api_headers;
+
+    include uwsgi_params;
+}
+location /avatar {
+    include /etc/nginx/zulip-include/api_headers;
+
+    include uwsgi_params;
+}
+location /user_uploads {
+    include /etc/nginx/zulip-include/api_headers;
+
+    include uwsgi_params;
+}
+
+location /api/internal/ {
+    # These only need be accessed from localhost
+    allow 127.0.0.1;
+    allow ::1;
+    deny all;
+
+    include /etc/nginx/zulip-include/api_headers;
+    include uwsgi_params;
+}
+
+# Send all API routes not covered above to Django via uWSGI
+location /api/ {
+    include /etc/nginx/zulip-include/api_headers;
+
+    include uwsgi_params;
+}
+
+include /etc/nginx/zulip-include/app.d/*.conf;

puppet/zulip/files/nginx/zulip-include-frontend/uploads-internal.conf

@@ -0,0 +1,88 @@
+# Handle redirects to S3
+location ~ ^/internal/s3/(?<s3_hostname>[^/]+)/(?<s3_path>.*) {
+    internal;
+    include /etc/nginx/zulip-include/headers;
+    add_header Content-Security-Policy "default-src 'none'; media-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self'; object-src 'self'; plugin-types application/pdf;";
+
+    # The components of this path are originally double-URI-escaped
+    # (see zerver/view/upload.py).  "location" matches are on
+    # unescaped values, which fills $s3_path with a properly
+    # single-escaped path to pass to the upstream server.
+    # (see associated commit message for more details)
+    set $download_url https://$s3_hostname/$s3_path;
+    proxy_set_header Host $s3_hostname;
+    proxy_ssl_name $s3_hostname;
+    proxy_ssl_server_name on;
+
+    # Strip off X-amz-cf-id header, which otherwise the request has to
+    # have been signed over, leading to signature mismatches.
+    proxy_set_header x-amz-cf-id "";
+
+    # Strip off any auth request headers which the Zulip client might
+    # have sent, as they will not work for S3, and will report an error due
+    # to the signed auth header we also provide.
+    proxy_set_header Authorization "";
+    proxy_set_header x-amz-security-token "";
+
+    # These headers are only valid if there is a body, but better to
+    # strip them to be safe.
+    proxy_set_header Content-Length "";
+    proxy_set_header Content-Type "";
+    proxy_set_header Content-MD5 "";
+    proxy_set_header x-amz-content-sha256 "";
+    proxy_set_header Expect "";
+
+    # Ensure that we only get _one_ of these response headers: the one
+    # that Django added, not the one from S3.
+    proxy_hide_header Cache-Control;
+    proxy_hide_header Expires;
+    proxy_hide_header Set-Cookie;
+    # We are _leaving_ S3 to provide Content-Type,
+    # Content-Disposition, and Accept-Ranges headers, which are the
+    # three remaining headers which nginx would also pass through from
+    # the first response.  Django explicitly unsets the first, and
+    # does not set the latter two.
+
+    # We slice the content into 5M chunks; this means that the client
+    # doesn't need to wait for nginx to download and cache the full
+    # content if the client just requested a small range (e.g. for
+    # showing a thumbnail of a large video).  5M is chosen to be
+    # enough for videos to be able to thumbnail in one slice, but not
+    # take overly long to retrieve from S3, or cause overwhelming
+    # numbers of cache entries for large files.
+    slice 5m;
+    proxy_set_header Range $slice_range;
+
+    proxy_pass $download_url$is_args$args;
+    proxy_cache uploads;
+    # If the S3 response doesn't contain Cache-Control headers (which
+    # we don't expect it to) then we assume they are valid for a very
+    # long time.  The size of the cache is controlled by
+    # `s3_disk_cache_size` and read frequency, set via
+    # `s3_cache_inactive_time`.
+    proxy_cache_valid 200 206 1y;
+
+    # We only include the requested content-disposition (and range
+    # slice) in the cache key, so that we cache "Content-Disposition:
+    # attachment" separately from the inline version.
+    proxy_cache_key $download_url$s3_disposition_cache_key$slice_range;
+}
+
+# Internal file-serving
+location /internal/local/uploads {
+    internal;
+    include /etc/nginx/zulip-include/headers;
+    add_header Content-Security-Policy "default-src 'none'; media-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self'; object-src 'self'; plugin-types application/pdf;";
+
+    # Django handles setting Content-Type, Content-Disposition, and Cache-Control.
+
+    alias /home/zulip/uploads/files;
+}
+
+location /internal/local/user_avatars {
+    internal;
+    include /etc/nginx/zulip-include/headers;
+    add_header Content-Security-Policy "default-src 'none'; img-src 'self'";
+    include /etc/nginx/zulip-include/uploads.types;
+    alias /home/zulip/uploads/avatars;
+}

puppet/zulip/files/nginx/zulip-include-frontend/uploads.types

@@ -0,0 +1,23 @@
+types {
+    text/plain                            txt;
+
+    application/pdf                       pdf;
+
+    image/gif                             gif;
+    image/jpeg                            jpeg jpg jpe;
+    image/png                             png;
+    image/tiff                            tif tiff;
+    image/webp                            webp;
+
+    video/3gpp                            3gpp 3gp;
+    video/mp4                             mp4;
+    video/mpeg                            mpeg mpg;
+    video/quicktime                       mov;
+    video/webm                            webm;
+    video/x-flv                           flv;
+    video/x-m4v                           m4v;
+    video/x-mng                           mng;
+    video/x-ms-asf                        asx asf;
+    video/x-ms-wmv                        wmv;
+    video/x-msvideo                       avi;
+}

puppet/zulip/files/nginx/zulip-include-frontend/upstreams

@@ -0,0 +1,17 @@
+include /etc/nginx/zulip-include/tornado-upstreams;
+
+upstream django {
+    server unix:/home/zulip/deployments/uwsgi-socket;
+}
+
+upstream localhost_sso {
+    server 127.0.0.1:8888;
+}
+
+upstream camo {
+    server 127.0.0.1:9292;
+}
+
+upstream tusd {
+    server 127.0.0.1:9900;
+}