marvin/Wizard
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Serve API and website behind Caddy path prefixes

Browse Source 
Caddy forwards /wizard/api/* and /wizard/website/* with the prefix
stripped, so the server received /ws instead of /api/ws and the website
connected to /api/ws on the domain root.

- Server routes are now /ws and /health (was /api/ws, /api/health)
- Website derives the websocket URL from its own location (../api/ws),
  giving /wizard/api/ws in production and /api/ws in development
- Vite dev proxy strips /api like the production proxy
- nginx back to the plain SPA config since Caddy strips the prefix
- /internal/ai rejects requests that came through the reverse proxy,
  in addition to the shared secret
- Docs updated for the prefixed deployment

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
marvin
2026-09-27 10:00:29 +02:00
co-authored by Claude Opus 5.5
parent 00c73306d7
commit 90176e1cca
13 changed files with 60 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
wizard_server/app/main.py
+15 -8
View File
@@ -1,10 +1,10 @@
"""FastAPI application of the Wizard game server.
Routes:
- ``GET /api/health`` health check
- ``WS /api/ws`` web clients (see ``app.protocol``)
- ``WS /internal/ai`` AI service (see ``app.ai_bridge``); not meant to be
exposed by the reverse proxy and protected by ``AI_SHARED_SECRET``
Routes (the reverse proxy strips its path prefix, e.g. ``/wizard/api``):
- ``GET /health`` health check
- ``WS /ws`` web clients (see ``app.protocol``)
- ``WS /internal/ai`` AI service (see ``app.ai_bridge``); only accepted from
direct connections on the internal network and protected by ``AI_SHARED_SECRET``
"""
from __future__ import annotations
@@ -39,7 +39,7 @@ def create_app(config: Settings = settings) -> FastAPI:
app = FastAPI(title="Wizard game server", lifespan=lifespan, docs_url=None, redoc_url=None)
app.state.service = service
@app.get("/api/health")
@app.get("/health")
async def health() -> dict:
return {
"status": "ok",
@@ -48,13 +48,13 @@ def create_app(config: Settings = settings) -> FastAPI:
"ai_available": service.bridge.available,
}
@app.websocket("/api/ws")
@app.websocket("/ws")
async def client_socket(websocket: WebSocket) -> None:
await service.handle_client(websocket)
@app.websocket("/internal/ai")
async def ai_socket(websocket: WebSocket) -> None:
if not _ai_authorized(websocket, config.ai_shared_secret):
if _via_proxy(websocket) or not _ai_authorized(websocket, config.ai_shared_secret):
await websocket.close(code=1008)
return
await service.handle_ai(websocket)
@@ -62,6 +62,13 @@ def create_app(config: Settings = settings) -> FastAPI:
return app
def _via_proxy(websocket: WebSocket) -> bool:
# The reverse proxy forwards everything below its prefix, including
# /internal/ai. Requests that went through it carry forwarding headers;
# the AI service connects directly over the internal network.
return any(name in websocket.headers for name in ("x-forwarded-for", "forwarded", "via"))
def _ai_authorized(websocket: WebSocket, secret: str) -> bool:
if not secret:
return True