chore: cleanup

2 files changed, 87 insertions, 1 deletions

diff --git a/linux/nginx/etc/nginx/conf.d/piped.conf b/linux/nginx/etc/nginx/conf.d/piped.conf
new file mode 100644
index 0000000..c1ac91e
--- /dev/null
+++ b/linux/nginx/etc/nginx/conf.d/piped.conf
@@ -0,0 +1,74 @@
+# Piped -- Host-based router on 127.0.0.1:8077
+#
+# WHY THIS EXISTS: the Cloudflare tunnel routes all three Piped hostnames to
+# localhost:8077 --
+#     piped.krz.sh       -> :8077
+#     pipedapi.krz.sh    -> :8077   (should be the backend)
+#     pipedproxy.krz.sh  -> :8077   (should be the media proxy)
+# so the API and media-proxy hostnames landed on the frontend and Piped was
+# broken. The frontend advertises BACKEND_HOSTNAME=pipedapi.krz.sh to browsers,
+# so every API call failed.
+#
+# The tidier fix is two edits in the Cloudflare dashboard (point pipedapi at
+# :8078 and pipedproxy at :8079). This file fixes it server-side instead, and
+# is harmless if the dashboard is corrected later -- the tunnel would simply
+# reach the containers directly and these blocks would go unused.
+#
+# Ports: frontend :8076 (moved from :8077), backend :8078, media proxy :8079.
+#
+# NOTE: custom.d/basic.conf is deliberately NOT included. Its Permissions-Policy
+# sets fullscreen=(), which would stop videos going fullscreen.
+
+# Frontend. default_server so the Tor onion for piped (which targets :8077 with
+# a .onion Host header) also lands here.
+server {
+    listen 127.0.0.1:8077 default_server;
+    server_name piped.krz.sh;
+
+    location / {
+        proxy_pass http://127.0.0.1:8076;
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_http_version 1.1;
+    }
+}
+
+# Backend API.
+server {
+    listen 127.0.0.1:8077;
+    server_name pipedapi.krz.sh;
+
+    location / {
+        proxy_pass http://127.0.0.1:8078;
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_http_version 1.1;
+        # The backend emits its own CORS headers; do not add or override any
+        # here or the browser will reject the API responses.
+        proxy_read_timeout 120;
+    }
+}
+
+# Media proxy. Streams video, so no buffering and generous timeouts.
+server {
+    listen 127.0.0.1:8077;
+    server_name pipedproxy.krz.sh;
+
+    location / {
+        proxy_pass http://127.0.0.1:8079;
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_http_version 1.1;
+
+        proxy_buffering off;
+        proxy_request_buffering off;
+        proxy_read_timeout 300;
+        proxy_send_timeout 300;
+    }
+}
diff --git a/linux/nginx/etc/nginx/nginx.conf b/linux/nginx/etc/nginx/nginx.conf
index dfcda27..0aeacc6 100644
--- a/linux/nginx/etc/nginx/nginx.conf
+++ b/linux/nginx/etc/nginx/nginx.conf
@@ -41,7 +41,19 @@ events {
 # Default: logs/error.log error
 # https://nginx.org/en/docs/ngx_core_module.html#error_log
 # error_log /var/log/nginx/error.log warn;
-error_log /dev/null emerg;
+#
+# emerg-only, to stderr -> systemd captures it into journald, which is RAM-only
+# on this host (Storage=volatile), so nothing lands on disk and nothing survives
+# a reboot.
+#
+# This was /dev/null, which discarded the one class of message that says the
+# server is broken. That cost real diagnostic time twice on 2026-08-03: a reload
+# that silently failed to rebind sockets, and the certbot failures. emerg
+# messages are startup/bind/shutdown faults and carry no visitor data, so
+# keeping them costs nothing in privacy terms.
+#
+# Read with: journalctl -u nginx
+error_log stderr emerg;
 
 # The file storing the process ID of the main process
 # Default: logs/nginx.pid