a73x

d5521a0e

site: the ssh-access redirect points somewhere a browser can go

a73x   2026-08-19 04:48

Commit message
site: the ssh-access redirect points somewhere a browser can go

nginx builds a redirect's Location from its own scheme and listen port
unless told not to, so /docs/ssh-access/ answered with
http://eitri.sh:8080/docs/connecting/ — the internal port, over http,
neither of which serves anyone outside the cluster. Redirects now go out
relative, and a test fails the build if a redirect is ever added back
without that.
internal/site/site_test.go
Old New
@@ -271,3 +271,14 @@ func TestShippedTemplateCarriesTheThemeControl(t *testing.T) {
271 } 271 }
272 } 272 }
273 } 273 }
274
275 // nginx builds an absolute Location from its own scheme and listen port
276 // unless told otherwise, and the site is served behind a proxy — so a
277 // redirect went out pointing at http://eitri.sh:8080, which serves nothing.
278 // Any redirect in the config has to be relative.
279 func TestNginxRedirectsRelatively(t *testing.T) {
280 conf := read(t, filepath.Join("..", "..", "site", "nginx.conf"))
281 if strings.Contains(conf, "return 301") && !strings.Contains(conf, "absolute_redirect off;") {
282 t.Error("site/nginx.conf redirects without absolute_redirect off — Location would name nginx's own port")
283 }
284 }
site/nginx.conf
Old New
@@ -1,6 +1,11 @@
1 server { 1 server {
2 listen 8080; 2 listen 8080;
3 server_name _; 3 server_name _;
4
5 # Redirects go out relative. nginx would otherwise build an absolute URL
6 # from its own scheme and listen port — behind the proxy that serves
7 # eitri.sh, a Location of http://eitri.sh:8080/... points nowhere.
8 absolute_redirect off;
4 root /usr/share/nginx/html; 9 root /usr/share/nginx/html;
5 index index.html; 10 index index.html;
6 11