mirror of
https://hubproxy.babadafafafafa.cn/https://github.com/1Panel-dev/1Panel.git
synced 2026-09-20 08:03:55 +08:00
70fc628c81
* feat(openresty): manage http-context directives via conf/http.d Add a managed-file mechanism for http-context nginx directives, mirroring the existing one for conf/modules-enabled. A separate directory is required because load_module is a main-context directive, so modules-enabled is included at the top level of nginx.conf and cannot host http-context directives. Files carry a 1panel-http- prefix; anything else in the directory is left untouched. Writes are atomic via a temporary file plus rename, and the directory is snapshotted so a failed nginx -t can be rolled back. The mechanism is inert when conf/http.d does not exist, which is the case for OpenResty installations predating the directory. * fix(openresty): correct gzip defaults and add missing compressible types Bring the embedded gzip template in line with how sites are actually served. It was previously dead code: nothing referenced gzip.conf, so the values never reached an installation. It is now embedded and used by the migration that follows. gzip_types was missing application/json, so JSON API responses were served uncompressed. Also add ld+json, text/xml, xhtml+xml, rss+xml, atom+xml, wasm, svg+xml and ttf/otf. Already compressed formats (images, woff2, archives) stay out on purpose. gzip_comp_level 6 -> 5, at the cost/ratio knee for gzip. gzip_proxied any, so that proxied responses are compressed regardless of their Cache-Control semantics. gzip_static is intentionally not enabled: nginx does not verify that a .gz file is newer than its source, so a stale artifact would be served indefinitely with no error. * feat(openresty): activate brotli directives when the module is enabled Enabling ngx_brotli only emitted load_module, leaving the module loaded but inert: no response was ever brotli-encoded until the user added `brotli on` and `brotli_types` to nginx.conf by hand. The module is prebuilt into the OpenResty image and listed in the catalog, so the only missing step was the runtime configuration. Enabling the module now also writes its http-context directives to conf/http.d, and disabling or deleting it removes them. Removal matters: leaving `brotli on` behind after the .so is unloaded makes nginx fail to start on an unknown directive. Both directory sets are written before nginx -t runs, so nginx only ever observes a consistent state, and a failed check rolls back load_module files and runtime directives together. Runtime defaults are declared per module in a table, so other modules needing http-context configuration can be added without touching the reconcile logic. brotli_types matches gzip_types so both encoders cover the same content. brotli_comp_level is 5 rather than the nginx default of 6: level 5 reaches roughly gzip level 9 ratio at a fraction of the cost, while 6 is tuned for static assets and is too expensive for dynamic responses. brotli_static is deliberately omitted, for the same reason gzip_static is: nginx does not verify that a precompressed artifact is newer than its source, so a stale file would be served indefinitely with no error. Installations without conf/http.d keep the previous behaviour instead of failing. * feat(openresty): refresh stock gzip defaults on upgrade Upgrades deliberately preserve the user's nginx.conf, so corrected gzip defaults shipped with a new OpenResty version never reach existing installations. Rewrite the values in place during upgrade, but only when the block is provably untouched. The rewrite requires every gzip directive to match the factory values byte for byte, with none missing, none added and none duplicated. Any deviation means the user tuned compression, and their configuration is left alone. gzip stays in the http block of nginx.conf rather than moving to an included file: nginx rejects a duplicate gzip directive across contexts, and the compression settings page reads and writes these same keys in nginx.conf, so a relocated block would be reintroduced on the next save and break nginx -t. The config parser is not used either. Its dumper regenerates the whole file, drops standalone comments and reorders proxy includes, which would be destructive on a user's main config. Lines are edited individually so everything outside the gzip block stays byte-identical. The rewrite is idempotent, and a failed nginx -t restores the previous file. A failure is logged as a warning instead of failing the upgrade. * fix(website): preserve size units in nginx performance settings The form stripped the unit suffix when reading a directive and then always appended a fixed one when saving, so the unit was silently reinterpreted. A config carrying `gzip_min_length 512;`, meaning 512 bytes, was read as 512 and written back as `512k`, inflating the threshold by 1024 and effectively disabling compression for every response under 512 KB. The same applied to client_header_buffer_size and client_max_body_size, where the value grew by a factor of 1024 in the opposite, riskier direction. Remember the unit that was read and write it back unchanged, defaulting to the previous suffix only when the directive carries no unit information. The input suffix now shows the unit actually in use instead of a hardcoded label. Also fix the value parsing itself: `Number(value.match(/\d+/g))` coerces a multi-number match to NaN, so a directive such as `gzip_buffers 4 16k` would blank the field. Take the first captured number instead. * feat(website): expose brotli settings in the compression page Brotli could be enabled as a module but never configured from the panel, so its behaviour was invisible and unchangeable without editing nginx.conf by hand. The section appears only once the module is enabled and built, since the directives are rejected by nginx while the module is not loaded. Values are read from and written to the panel-managed http.d file rather than nginx.conf, so they are removed together with the module. brotli_types stays out of the form on purpose: it is kept aligned with gzip_types so both encoders cover the same content, and exposing it would invite the two lists to drift apart. Saving reuses the existing scope endpoint with a dedicated brotli scope, which keeps the managed file as the single source of truth instead of duplicating the values into nginx.conf. * fix(openresty): stop a stale build option from forcing a full rebuild Manual builds and upgrades disagreed on when a full OpenResty image rebuild is required. `executeNginxModuleBuild` used `staticNginxBuildRequired`, which also treated a non-empty `RESTY_CONFIG_OPTIONS_MORE` in .env as a reason to rebuild, while `buildNginx` looked only at the module list. The env value is derived state, not an input: `configureStaticNginxModules` rewrites it from the current module list, and every build path calls that function before building. With no static module enabled it writes an empty string, so the rebuild the latch triggered ran with an empty option list and could only reproduce the image it started from — up to 120 minutes of build time to arrive back where it began. Decide on the module list alone, which is what the upgrade path already did. An install that genuinely has an enabled static module is unaffected: both predicates already agreed in that case. Leftover values are still cleared, by `configureStaticNginxModules` on the next build or upgrade. * feat(openresty): build modules on versions without a dynamic builder Module state written before build modes existed carries no buildMode. validateNginxModuleBuildMode rejects the empty value, which fails loadNginxModules and with it every module operation and the upgrade itself — the whole module subsystem, not just the static feature. Infer the missing value from what the install can actually do instead: dynamic when the builder and catalog are present, static when the compose file still has a build section and build/Dockerfile to recompile the image. Builds follow the same principle. Asking a pre-dynamic install to build a module used to return "the installed OpenResty version does not support dynamic module builds", which is a dead end: these versions produce modules by compiling them into the image, and they still can. Such a build is now retargeted to the static path, with --add-dynamic-module rewritten back to --add-module and =dynamic switches reduced to their plain form. The error is kept only for installs that reference a prebuilt image and genuinely cannot compile anything, and it now says so and points at the upgrade. The retarget applies to a copy that drives one build and is never persisted, so the catalog stays authoritative and modules return to dynamic once the install gains a builder. Verified end to end against 1.27.1.2-5-1-focal, which ships no Dockerfile.modules and no module.catalog.json: ngx_brotli compiles into the image, nginx -t accepts the brotli directives with no load_module present, and the server responds with Content-Encoding: br. * feat(openresty): respect a hand-written brotli configuration A user who enabled brotli before the panel managed it did so by editing their configuration by hand. Emitting a managed file alongside it defined every directive twice and nginx refused to start, so these users — the very ones this feature is for — broke on upgrade. Detection now scans every file nginx loads brotli from: nginx.conf and the conf.d and default includes. Any active brotli* directive counts, so a lone tuning directive is enough to treat the module as user-managed, and a commented-out line never triggers it. When the user owns the configuration, the panel stays out of the way: - No managed http.d file is written, so the user's definition stays the only one and their values are never overridden. - brotli_types diverging from gzip_types is left exactly as written; the panel does not widen them. - The settings page reports their real values and shows a notice that brotli is managed manually, rather than presenting defaults that do not match the running configuration. - Saving edits their own lines in place, keeping indentation and comments, instead of writing a second copy. The flag is localised in all 12 languages. Detection re-runs on every reconcile, so once the user deletes their hand-written config the panel takes over again automatically. * feat(openresty): wire conf/http.d from the agent instead of upgrade scripts Following review feedback: setup scripts no longer create conf/http.d or inject its include into existing installations' nginx.conf. The agent owns the directory, the include, the runtime directives and the rollback, and only touches nginx.conf when a module that needs http-context configuration is actually enabled. Insertion is a line-level edit, never the config parser: the include lands before the conf.d include, or at the top of the http block when that anchor is absent, keeping the surrounding indentation and leaving the rest of the file byte-identical. A config without a locatable http block degrades to the previous behaviour — module loads, runtime directives skipped, warning logged — instead of failing the operation. Detection re-runs on every reconcile, so an install recovers on its own once nginx.conf can be edited again. Rollback now covers three artefacts: modules-enabled, http.d, and the inserted line in nginx.conf. The include is kept when the last module is disabled. Pointing at an empty directory is harmless, and removing it would mean another edit of the user's main config with its own failure surface. When the include is missing and cannot be inserted, the brotli settings report ManagedUnavailable and the settings page warns that the values shown will not take effect, instead of presenting inert settings as live. * fix(openresty): tighten brotli ownership handling and build guards The settings page could not save brotli values for users who wrote their own directives after the panel had started managing the module: the stale managed file was still on disk, so every save ended in a duplicate directive error. That file is now removed before the in-place edit, and a failed nginx -t rolls back both sides. User-managed detection now also covers conf/default, which is included at http scope like conf.d, and the http.d include check no longer depends on the exact container path literal, so an include written in a slightly different form is recognised instead of duplicated. The dynamic-to-static build fallback is dropped. The catalog and the dynamic builder ship together, and installs without the catalog fail to load their module state earlier anyway, so the branch could never run; what remains is an error that says the version cannot build modules and to upgrade first. The embedded gzip template is no longer wired to an unused variable, and a test keeps it in sync with the defaults the upgrade writes. Smaller fixes in the same area: a custom module named ngx_brotli no longer inherits the built-in runtime defaults; nginx.conf edits go through temp file renames and inserted lines follow the file's own line endings; the gzip rewrite keeps each line's own indentation; the settings page resets its unit cache on load, warns when the brotli half of a save fails after gzip already applied, and no longer coerces unrendered keys to zero. * fix(openresty): prove brotli reached the running server, not just disk nginx -t and a successful reload both pass even when the managed directory never reaches the container: the include is a glob, so a missing bind mount or an unrecognised include variant silently loads nothing. The brotli save now reads the effective configuration back with nginx -T and rolls the write back with an actionable error when the directives are not there, instead of reporting success for settings nobody will ever see. The include match also accepts the quoted form nginx permits, so a hand-written or legacy variant no longer invites a second include of the same directory. Values written into nginx.conf are checked against a whitelist before any file is touched. The UI only ever sends on/off, numbers and sizes, but the endpoint is reachable directly, and an unfiltered value could inject a directive or trip the group-reference expansion of regexp.ReplaceAllString in the in-place rewrite.