lronetto/lronetto-main
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(caddy): não reescrever Host no proxy do media (quebrava assinatura S3)

Browse Source 
As URLs pré-assinadas SigV4 incluem o header host na assinatura, calculado
com media.{DOMAIN_BASE}. O header_up Host {upstream_hostport} reescrevia pra
minio:9000, causando SignatureDoesNotMatch (403) nos uploads PUT do browser.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Leandro Ronetto 2026-06-09 11:03:20 -03:00
parent c1f8b12d3c
commit 7b79647030
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
caddy/Caddyfile
View File

@ -44,7 +44,9 @@ minio.{$DOMAIN_BASE} {
# ----- MinIO S3 API público (uploads/downloads do bucket) -----
media.{$DOMAIN_BASE} {
encode gzip
reverse_proxy minio:9000 {
header_up Host {upstream_hostport}
}
# NÃO reescrever o Host: as URLs pré-assinadas (SigV4) incluem o header
# `host` na assinatura, calculado com `media.{DOMAIN_BASE}`. O Caddy
# repassa o Host original por padrão; reescrever pra `minio:9000`
# quebraria a assinatura (SignatureDoesNotMatch / 403 no PUT).
reverse_proxy minio:9000
}