Reconfigure MinIO to be proxied through Nginx

This change is necessary because some games need to connect to a S3 server directly, and MinIO is limited to listening on one domain for virtual hosts.

compose.yml

@@ -105,6 +105,7 @@ services:
     image: minio/minio:latest
     depends_on:
       - coredns-internal
+      - nginx
     restart: unless-stopped
     ports:
       # Web console

config/internal.Corefile

@@ -5,6 +5,5 @@
     rewrite name regex (.*\.)?pretendo\.cc nginx answer auto
     rewrite name regex (.*\.)?pretendo\.network nginx answer auto
     rewrite name regex (.*\.)?pretendo-cdn\.b-cdn\.net nginx answer auto
-    rewrite name regex (.*\.)?minio minio answer auto
     forward . /etc/resolv.conf
 }

config/nginx/cdn.conf

@@ -3,12 +3,8 @@ server {
     listen 443 ssl;
     server_name cdn.pretendo.cc mii.olv.pretendo.cc pretendo-cdn.b-cdn.net;
 
-    set $upstream http://pn-cdn.minio:9000;
+    set $upstream http://pn-cdn.minio.pretendo.cc;
     location / {
-        limit_except GET HEAD {
-            deny all;
-        }
-
         proxy_pass $upstream;
     }
 }

config/nginx/minio.conf

@@ -0,0 +1,16 @@
+server {
+    listen 80;
+    # Listening on ports 9000 and 80 at the same time causes the error "The request signature we calculated does not
+    # match the signature you provided." This seems to be due to how S3 signatures are calculated: the client calculates
+    # it based on the endpoint it is configured with, and the server calculates it based on the Host header it recieves.
+    # So, if the client send a request using port 9000 but the reverse proxy sends a Host header without a port, the
+    # signature will not match. Limiting the reverse proxy to listen only on default ports fixes this.
+    listen 443 ssl;
+    server_name minio.pretendo.cc pn-cdn.minio.pretendo.cc pn-boss.minio.pretendo.cc super-mario-maker.minio.pretendo.cc;
+
+    set $upstream http://minio:9000;
+    location / {
+        proxy_pass $upstream;
+        proxy_set_header Host $host;
+    }
+}

environment/account.env

@@ -6,7 +6,7 @@ PN_ACT_CONFIG_MONGOOSE_OPTION_useNewUrlParser=true
 PN_ACT_CONFIG_MONGOOSE_OPTION_useUnifiedTopology=true
 PN_ACT_CONFIG_WEBSITE_BASE=https://pretendo.network
 PN_ACT_CONFIG_REDIS_URL=redis://redis:6379
-PN_ACT_CONFIG_S3_ENDPOINT=http://minio:9000
+PN_ACT_CONFIG_S3_ENDPOINT=http://minio.pretendo.cc
 PN_ACT_CONFIG_S3_ACCESS_KEY=minio_pretendo
 PN_ACT_CONFIG_CDN_BASE_URL=https://cdn.pretendo.cc
 PN_ACT_CONFIG_CDN_SUBDOMAIN=cdn

environment/boss.env

@@ -6,7 +6,7 @@ PN_BOSS_CONFIG_GRPC_ACCOUNT_SERVER_ADDRESS=account
 PN_BOSS_CONFIG_GRPC_ACCOUNT_SERVER_PORT=5000
 PN_BOSS_CONFIG_MONGO_CONNECTION_STRING=mongodb://mongodb:27017/pretendo_boss?replicaSet=rs
 PN_BOSS_CONFIG_CDN_DOWNLOAD_URL=https://npdi.cdn.pretendo.cc
-PN_BOSS_CONFIG_S3_ENDPOINT=http://minio:9000
+PN_BOSS_CONFIG_S3_ENDPOINT=http://minio.pretendo.cc
 PN_BOSS_CONFIG_S3_REGION=us-east-1
 PN_BOSS_CONFIG_S3_BUCKET=pn-boss
 PN_BOSS_CONFIG_S3_ACCESS_KEY=minio_pretendo

environment/juxtaposition-ui.env

@@ -9,5 +9,5 @@ JUXT_CONFIG_GRPC_ACCOUNT_IP=account
 JUXT_CONFIG_GRPC_ACCOUNT_PORT=5000
 JUXT_CONFIG_WHITELIST=1|http,mii.olv.pretendo.cc,,2|1|https,mii.olv.pretendo.cc,,2|1|http,cdn.olv.pretendo.cc,,2|1|https,cdn.olv.pretendo.cc,,2|1|https,kaeru.b-cdn.net,,2|1|https,cdn.jsdelivr.net,,2|1|http,kt-imogen.b-cdn.net,,2|1|http,youtube.com,,2|http,portal.cdn.pretendo.cc,,2|https,portal.cdn.pretendo.cc,,2|http,pretendo-cdn.b-cdn.net,,2|https,pretendo-cdn.b-cdn.net,,2|https,youtube.com,,2|http,.youtube.com,,2|https,.youtube.com,,2|http,.ytimg.com,,2|https,.ytimg.com,,2|http,.googlevideo.com,,2|https,.googlevideo.com,,2|https,youtube.com,/embed/,6|https,youtube.com,/e/,6|https,youtube.com,/v/,6|https,www.youtube.com,/embed/,6|https,www.youtube.com,/e/,6|https,www.youtube.com,/v/,6|https,youtube.googleapis.com,/e/,6|https,youtube.googleapis.com,/v/,6|http,maps.googleapis.com,/maps/api/streetview,2|https,maps.googleapis.com,/maps/api/streetview,2|http,cbk0.google.com,/cbk,2|https,cbk0.google.com,/cbk,2|http,cbk1.google.com,/cbk,2|https,cbk1.google.com,/cbk,2|http,cbk2.google.com,/cbk,2|https,cbk2.google.com,/cbk,2|http,cbk3.google.com,/cbk,2|https,cbk3.google.com,/cbk,2|https,.cloudfront.net,,2|https,www.google-analytics.com,/,2|https,stats.g.doubleclick.net,,2|https,www.google.com,/ads/,2|https,ssl.google-analytics.com,,2|http,fonts.googleapis.com,,2|fonts.googleapis.com,,2|https,www.googletagmanager.com,,2|http,miiverse.cc,,2|https,miiverse.cc,,2
 JUXT_CONFIG_POST_LIMIT=20
-JUXT_CONFIG_AWS_SPACES_ENDPOINT=http://minio:9000
+JUXT_CONFIG_AWS_SPACES_ENDPOINT=http://minio.pretendo.cc
 JUXT_CONFIG_AWS_SPACES_KEY=minio_pretendo

environment/miiverse-api.env

@@ -2,7 +2,7 @@ PN_MIIVERSE_API_CONFIG_HTTP_PORT=8080
 PN_MIIVERSE_API_CONFIG_ACCOUNT_SERVER_ADDRESS=account
 PN_MIIVERSE_API_CONFIG_MONGO_CONNECTION_STRING=mongodb://mongodb:27017/pretendo_miiverse?replicaSet=rs
 PN_MIIVERSE_API_CONFIG_MONGOOSE_CONNECT_OPTIONS_PATH=/app/mongoose-connect-options.json
-PN_MIIVERSE_API_CONFIG_S3_ENDPOINT=http://minio:9000
+PN_MIIVERSE_API_CONFIG_S3_ENDPOINT=http://minio.pretendo.cc
 PN_MIIVERSE_API_CONFIG_S3_ACCESS_KEY=minio_pretendo
 PN_MIIVERSE_API_CONFIG_GRPC_FRIENDS_IP=friends
 PN_MIIVERSE_API_CONFIG_GRPC_FRIENDS_PORT=5001

environment/minio.env

@@ -1,4 +1,4 @@
 MINIO_VOLUMES=/data
-MINIO_DOMAIN=minio
+MINIO_DOMAIN=minio.pretendo.cc
 MINIO_ROOT_USER=minio_pretendo
 MINIO_BROWSER_REDIRECT=false

environment/super-mario-maker.env

@@ -1,6 +1,6 @@
 PN_SMM_AUTHENTICATION_SERVER_PORT=6004
 PN_SMM_SECURE_SERVER_PORT=6005
-PN_SMM_CONFIG_S3_ENDPOINT=minio:9000
+PN_SMM_CONFIG_S3_ENDPOINT=minio.pretendo.cc
 PN_SMM_CONFIG_S3_ACCESS_KEY=minio_pretendo
 PN_SMM_CONFIG_S3_BUCKET=super-mario-maker
 PN_SMM_ACCOUNT_GRPC_HOST=account

scripts/run-in-container/minio-init.sh

@@ -2,7 +2,7 @@
 
 set -eu
 
-while ! mc alias set minio http://minio:9000 "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD" >/dev/null 2>&1; do
+while ! mc alias set minio http://minio.pretendo.cc "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD" >/dev/null 2>&1; do
     echo "Waiting for MinIO to start..."
     sleep 1
 done