Josep Piguillem
233c46e9fa
- What reaches the bell also reaches the devices where the person turned «Avisos en este dispositivo» on, with TaskStream closed: the Notifier sends each new notification encrypted (aes128gcm) and signed with VAPID, and forgets subscriptions the push service dropped (404/410). A failure never blocks the event stream. - The API keeps one subscription per device (push_subscriptions) and exposes the VAPID public key in the notification settings; GraphQL subscribePush/unsubscribePush, REST /me/push-subscriptions. Without VAPID_PUBLIC_KEY and VAPID_PRIVATE_KEY push is off. - The web registers /push-sw.js, a service worker that only shows the notification and opens its ticket on a tap (no caching, served without cache by nginx), and a manifest that makes it installable, which iPhones need for push. - The bell's toggles show their text next to them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
56 lines
1.7 KiB
Nginx Configuration File
56 lines
1.7 KiB
Nginx Configuration File
# Same-origin API for the SPA: REST under /api, GraphQL (HTTP + WebSocket) under /graphql.
|
|
# The API is reached by its unique alias (task-stream-api), not by the service name `api`:
|
|
# on a shared network (Dokploy) another project's `api` would get half of the requests.
|
|
map $http_upgrade $connection_upgrade {
|
|
default upgrade;
|
|
'' close;
|
|
}
|
|
|
|
server {
|
|
listen 80;
|
|
root /usr/share/nginx/html;
|
|
|
|
location /api/ {
|
|
# Attachments: the API takes files up to ATTACHMENTS_MAX_MB (25 MB by default).
|
|
client_max_body_size 30m;
|
|
proxy_pass http://task-stream-api:3000;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
}
|
|
|
|
location /graphql {
|
|
proxy_pass http://task-stream-api:3000;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
proxy_set_header Host $host;
|
|
# Subscriptions keep the socket open.
|
|
proxy_read_timeout 1h;
|
|
}
|
|
|
|
# The service worker and the manifest have no hash in their name: never
|
|
# cached, or browsers would keep an old one (exact matches win over the
|
|
# regex below).
|
|
location = /push-sw.js {
|
|
add_header Cache-Control "no-cache";
|
|
try_files $uri =404;
|
|
}
|
|
location = /manifest.webmanifest {
|
|
add_header Cache-Control "no-cache";
|
|
default_type application/manifest+json;
|
|
try_files $uri =404;
|
|
}
|
|
|
|
# Hashed bundles can be cached forever; index.html never.
|
|
location ~* \.(js|css|woff2?|svg|png|ico)$ {
|
|
expires 1y;
|
|
add_header Cache-Control "public, immutable";
|
|
try_files $uri =404;
|
|
}
|
|
|
|
location / {
|
|
add_header Cache-Control "no-cache";
|
|
try_files $uri $uri/ /index.html;
|
|
}
|
|
}
|