sdarbinyan/marketplaces
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(api): share base-domain API host
Some checks failed
Architecture Governance / architecture (push) Has been cancelled
Details

Browse Source 
Tenant subdomains route through api.<base-domain>; nginx forwards the exact storefront host derived from the validated browser origin.
This commit is contained in:
sdarbinyan
2026-08-20 16:12:37 +04:00
parent e5949c3967
commit 9cd56586fb
15 changed files with 175 additions and 65 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
scripts/deploy/configure-api-domain.sh
View File

@@ -1,6 +1,6 @@
#!/usr/bin/env bash
# Configure api.<storefront-domain> as the TLS/CORS reverse proxy for one tenant.
# Idempotent. Run as root after both storefront and API DNS records resolve here.
# Configure one shared api.<base-domain> for the base storefront and all tenant
# subdomains. Idempotent. Run as root after the API DNS record resolves here.
set -euo pipefail
@@ -30,6 +30,7 @@ done
API_DOMAIN="api.$DOMAIN"
CONF="/etc/nginx/sites-available/$API_DOMAIN"
DOMAIN_REGEX="${DOMAIN//./\\.}"
echo "==> checking DNS for $API_DOMAIN"
getent hosts "$API_DOMAIN" >/dev/null || {
@@ -39,7 +40,7 @@ getent hosts "$API_DOMAIN" >/dev/null || {
cat > "$CONF" <<NGINX
# Managed by marketplaces configure-api-domain.sh. Manual edits are overwritten.
# Storefront $DOMAIN derives this API origin as https://$API_DOMAIN.
# Storefront $DOMAIN and its tenant subdomains share https://$API_DOMAIN.
server {
listen 80;
listen [::]:80;
@@ -49,7 +50,11 @@ server {
error_log /var/log/nginx/$API_DOMAIN.error.log;
set \$cors_origin "";
if (\$http_origin = "https://$DOMAIN") { set \$cors_origin \$http_origin; }
set \$storefront_host "$DOMAIN";
if (\$http_origin ~* "^https://(?<allowed_storefront>([a-z0-9-]+\\.)*$DOMAIN_REGEX)$") {
set \$cors_origin \$http_origin;
set \$storefront_host \$allowed_storefront;
}
add_header Access-Control-Allow-Origin \$cors_origin always;
add_header Access-Control-Allow-Credentials "true" always;
@@ -62,12 +67,11 @@ server {
location / {
proxy_pass $UPSTREAM;
proxy_http_version 1.1;
# Keep the existing backend compatible: it already serves this tenant
# when the storefront Host reaches :445. The original public API host
# remains available in the trusted forwarding headers below.
proxy_set_header Host $DOMAIN;
# Browser Origin selects the storefront tenant while every tenant under
# this base domain shares one public API hostname.
proxy_set_header Host \$storefront_host;
proxy_set_header X-Forwarded-Host $API_DOMAIN;
proxy_set_header X-Storefront-Host $DOMAIN;
proxy_set_header X-Storefront-Host \$storefront_host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;