From 7b79647030b1ee9cff89f24d4a1e05b1e8a63387 Mon Sep 17 00:00:00 2001 From: Leandro Ronetto Date: Tue, 9 Jun 2026 11:03:20 -0300 Subject: [PATCH] =?UTF-8?q?fix(caddy):=20n=C3=A3o=20reescrever=20Host=20no?= =?UTF-8?q?=20proxy=20do=20media=20(quebrava=20assinatura=20S3)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit As URLs pré-assinadas SigV4 incluem o header host na assinatura, calculado com media.{DOMAIN_BASE}. O header_up Host {upstream_hostport} reescrevia pra minio:9000, causando SignatureDoesNotMatch (403) nos uploads PUT do browser. Co-Authored-By: Claude Opus 4.8 --- caddy/Caddyfile | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/caddy/Caddyfile b/caddy/Caddyfile index 34ed6c5..12a0245 100644 --- a/caddy/Caddyfile +++ b/caddy/Caddyfile @@ -44,7 +44,9 @@ minio.{$DOMAIN_BASE} { # ----- MinIO S3 API público (uploads/downloads do bucket) ----- media.{$DOMAIN_BASE} { encode gzip - reverse_proxy minio:9000 { - header_up Host {upstream_hostport} - } + # NÃO reescrever o Host: as URLs pré-assinadas (SigV4) incluem o header + # `host` na assinatura, calculado com `media.{DOMAIN_BASE}`. O Caddy + # repassa o Host original por padrão; reescrever pra `minio:9000` + # quebraria a assinatura (SignatureDoesNotMatch / 403 no PUT). + reverse_proxy minio:9000 }