From 61d190ed918173aab5863689378b490ce13a5f9d Mon Sep 17 00:00:00 2001 From: Roman Priesol Date: Tue, 15 Sep 2026 22:24:40 +0200 Subject: [PATCH] Move behind nginx reverse proxy: app binds 127.0.0.1:4567, nginx owns :80 Avoids the cap_net_bind_service dance breaking on every RVM ruby patch upgrade (it happened today after today's ruby-4.0.7 install). --- app.rb | 6 ++++-- nginx-labelprint.conf | 20 ++++++++++++++++++++ 2 files changed, 24 insertions(+), 2 deletions(-) create mode 100644 nginx-labelprint.conf diff --git a/app.rb b/app.rb index 05aeb1e..2384d3f 100644 --- a/app.rb +++ b/app.rb @@ -8,8 +8,10 @@ require_relative 'lib/label_repository' set :protection, :except => :frame_options set :environment, :production -set :bind, "::" -set :port, 80 +# nginx reverse-proxies :80 -> here. Loopback-only and an unprivileged port +# means no more cap_net_bind_service dance on every RVM ruby upgrade. +set :bind, "127.0.0.1" +set :port, 4567 if !File.exist?('config.json') || !File.readable?('config.json') raise RuntimeException, 'Could not read config.json' diff --git a/nginx-labelprint.conf b/nginx-labelprint.conf new file mode 100644 index 0000000..f291090 --- /dev/null +++ b/nginx-labelprint.conf @@ -0,0 +1,20 @@ +# Installed at /etc/nginx/sites-available/labelprint on rpi-printserver +# (symlinked into sites-enabled), not auto-deployed -- kept here just so a +# reflash/rebuild isn't a guessing game. nginx owns :80 so the app itself +# never needs cap_net_bind_service (which a plain RVM ruby patch upgrade +# silently drops, since it's tied to the old binary's path). +server { + listen 80 default_server; + listen [::]:80 default_server; + server_name rpi-printserver.hv.priesol.net; + + client_max_body_size 20m; + + location / { + proxy_pass http://127.0.0.1:4567; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } +}