chore: add docker infrastructure, gists feature, attachment system, and admin CLI tools

- Add .dockerignore, Dockerfile, and docker compose targets to Makefile for containerized deployment - Implement gists router with CRUD operations, database schema, and polymorphic comment/vote reuse - Create attachment upload system with thumbnail generation, MIME detection, and storage path management - Add attachments_prune CLI command to clean orphaned attachment records and files - Introduce rate limiting middleware with 60 requests per minute window - Add custom 404 and 500 error handlers with SEO-optimized template responses - Extend database initialization with gists and attachments indexes plus upload site settings defaults - Update load_comments to include attachment mapping for comment resources - Register gists and uploads routers in main application and update AGENTS.md documentation
2026-05-12 13:07:34 +00:00
parent ff2585b098
commit aa88f18c03
69 changed files with 3069 additions and 450 deletions
@@ -0,0 +1,55 @@
+upstream app {
+    server app:10500;
+}
+
+proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=app_cache:10m max_size=${NGINX_CACHE_MAX_SIZE:-1g} inactive=60m use_temp_path=off;
+
+server {
+    listen 80;
+    server_name _;
+
+    client_max_body_size 20M;
+
+    add_header X-Content-Type-Options nosniff;
+    add_header X-Frame-Options DENY;
+    add_header X-XSS-Protection "1; mode=block";
+    add_header Referrer-Policy strict-origin-when-cross-origin;
+
+    gzip on;
+    gzip_types text/plain text/css text/javascript application/javascript application/json image/svg+xml;
+    gzip_min_length 1000;
+    gzip_vary on;
+    gzip_proxied any;
+
+    location /static/ {
+        alias /app/static/;
+        expires 7d;
+        add_header Cache-Control "public, immutable, max-age=604800";
+        access_log off;
+        log_not_found off;
+    }
+
+    location /avatar/ {
+        proxy_pass http://app;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    location / {
+        proxy_pass http://app;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_http_version 1.1;
+        proxy_set_header Connection "";
+
+        proxy_connect_timeout 30s;
+        proxy_read_timeout 60s;
+        proxy_send_timeout 60s;
+
+        ${NGINX_CACHE_CONFIG}
+    }
+}