From f44566963daf61fce4d8608e7c5e8c27c5853a88 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20Barrag=C3=A1n=20Merino?= Date: Mon, 26 Oct 2026 08:53:30 +0000 Subject: [PATCH] :rewind: Revert the subpath support brought by the docker/ backport MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The backport of docker/ from develop (2df5f417a) also brought the subpath support from #12358 and its fix (95bc48a08). It needs the Admin Console from 2.20, so with the current one every Admin Console URL fails. Restore the previous nginx configuration and docker-compose.yaml. AI-assisted-by: Claude Signed-off-by: David Barragán Merino --- docker/images/docker-compose.yaml | 5 ----- ...ginx-admin-console-locations.conf.template | 6 +----- docker/images/files/nginx-entrypoint.sh | 19 +------------------ docker/images/files/nginx.conf.template | 6 ++---- 4 files changed, 4 insertions(+), 32 deletions(-) diff --git a/docker/images/docker-compose.yaml b/docker/images/docker-compose.yaml index 4c69760e24..e667bc3049 100644 --- a/docker/images/docker-compose.yaml +++ b/docker/images/docker-compose.yaml @@ -26,9 +26,6 @@ x-flags: &penpot-flags PENPOT_FLAGS: disable-email-verification enable-smtp enable-prepl-server disable-secure-session-cookies enable-mcp enable-admin-console -## Public URI where Penpot is reached. To serve Penpot from a subpath, include -## it with a trailing slash, e.g. https://example.com/penpot/. A reverse proxy in -## front must forward the subpath unchanged, without rewriting it. x-uri: &penpot-public-uri PENPOT_PUBLIC_URI: http://localhost:9001 @@ -113,8 +110,6 @@ services: # ## internet with HTTPS using traefik. # - "traefik.http.routers.penpot-https.rule=Host(``)" - # ## When Penpot is served from a subpath, match it too: - # - "traefik.http.routers.penpot-https.rule=Host(``) && PathPrefix(`/`)" # - "traefik.http.routers.penpot-https.entrypoints=websecure" # - "traefik.http.routers.penpot-https.tls.certresolver=letsencrypt" # - "traefik.http.routers.penpot-https.tls=true" diff --git a/docker/images/files/nginx-admin-console-locations.conf.template b/docker/images/files/nginx-admin-console-locations.conf.template index a2a90913b0..fead3783c9 100644 --- a/docker/images/files/nginx-admin-console-locations.conf.template +++ b/docker/images/files/nginx-admin-console-locations.conf.template @@ -1,11 +1,7 @@ -# The Admin Console is served at the root of its own server. Keep proxy_pass -# without a URI: building it from $request_uri escapes the path twice. location /admin-console { - rewrite "^/admin-console(?:/(.*))?$" /$1 break; - proxy_http_version 1.1; proxy_set_header Host $http_host; proxy_set_header X-Real-IP $http_cf_connecting_ip; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_pass $PENPOT_ADMIN_CONSOLE_URI; + proxy_pass $PENPOT_ADMIN_CONSOLE_URI$request_uri; } diff --git a/docker/images/files/nginx-entrypoint.sh b/docker/images/files/nginx-entrypoint.sh index d60a5d691f..3ec97403a8 100644 --- a/docker/images/files/nginx-entrypoint.sh +++ b/docker/images/files/nginx-entrypoint.sh @@ -51,23 +51,6 @@ update_oidc_name /var/www/app/js/config.js ## Nginx Config ######################################### -# Path of PENPOT_PUBLIC_URI (e.g. /penpot/ for https://example.com/penpot/). -# Requests below it are rewritten to the root, so the proxy in front of this -# server forwards them unchanged. -PENPOT_PUBLIC_PATH="$(sed -E 's|^[A-Za-z][A-Za-z0-9+.-]*://[^/]*||; s|[?#].*$||' <<< "${PENPOT_PUBLIC_URI:-}")" -PENPOT_PUBLIC_PATH="/${PENPOT_PUBLIC_PATH#/}" -export PENPOT_PUBLIC_PATH="${PENPOT_PUBLIC_PATH%/}/" - -if [ "$PENPOT_PUBLIC_PATH" != "/" ]; then - # shellcheck disable=SC2016 # literal regex metacharacters - _public_path_regex="$(sed -E 's/[][\.*^$(){}+?|]/\\&/g' <<< "$PENPOT_PUBLIC_PATH")" - export PENPOT_PUBLIC_PATH_DIRECTIVES="location = ${PENPOT_PUBLIC_PATH%/} { absolute_redirect off; return 301 ${PENPOT_PUBLIC_PATH}\$is_args\$args; } - rewrite ^${_public_path_regex}(.*)\$ /\$1 last;" - unset _public_path_regex -else - export PENPOT_PUBLIC_PATH_DIRECTIVES="" -fi - export PENPOT_BACKEND_URI=${PENPOT_BACKEND_URI:-http://penpot-backend:6060} export PENPOT_EXPORTER_URI=${PENPOT_EXPORTER_URI:-http://penpot-exporter:6061} export PENPOT_HTTP_SERVER_MAX_BODY_SIZE=${PENPOT_HTTP_SERVER_MAX_BODY_SIZE:-367001600} # Default to 350MiB @@ -75,7 +58,7 @@ export PENPOT_IPV6_LISTEN_DIRECTIVE=${PENPOT_IPV6_LISTEN_DIRECTIVE:-"listen [::] if is_truthy "${PENPOT_DISABLE_IPV6_LISTEN:-}"; then export PENPOT_IPV6_LISTEN_DIRECTIVE="" fi -envsubst "\$PENPOT_BACKEND_URI,\$PENPOT_EXPORTER_URI,\$PENPOT_HTTP_SERVER_MAX_BODY_SIZE,\$PENPOT_IPV6_LISTEN_DIRECTIVE,\$PENPOT_PUBLIC_PATH,\$PENPOT_PUBLIC_PATH_DIRECTIVES" \ +envsubst "\$PENPOT_BACKEND_URI,\$PENPOT_EXPORTER_URI,\$PENPOT_HTTP_SERVER_MAX_BODY_SIZE,\$PENPOT_IPV6_LISTEN_DIRECTIVE" \ < /tmp/nginx.conf.template > /etc/nginx/nginx.conf if [[ $PENPOT_FLAGS == *"enable-admin-console"* ]]; then diff --git a/docker/images/files/nginx.conf.template b/docker/images/files/nginx.conf.template index c8800b0503..0451e7a24a 100644 --- a/docker/images/files/nginx.conf.template +++ b/docker/images/files/nginx.conf.template @@ -102,8 +102,6 @@ http { root /var/www/app/; - ${PENPOT_PUBLIC_PATH_DIRECTIVES} - location @handle_redirect { set $redirect_uri "$upstream_http_location"; set $redirect_host "$upstream_http_x_host"; @@ -169,7 +167,7 @@ http { location /readyz { access_log off; proxy_set_header Host $proxy_host; - proxy_pass $PENPOT_BACKEND_URI$uri$is_args$args; + proxy_pass $PENPOT_BACKEND_URI$request_uri; } location /ws/notifications { @@ -200,7 +198,7 @@ http { } location ~ ^/[^/]+/(.*)$ { - return 301 " ${PENPOT_PUBLIC_PATH}404"; + return 301 " /404"; } if ($penpot_link_preview_agent) {