Document archy-x250-dev3 deployment

Dedicated nginx server block on :8543 (not proxied under the dashboard's 80/443) because the dashboard sets Permissions-Policy: geolocation=() server-wide, which would silently break Regress's core claim/link mechanic. Also documents a found-but-not-fixed gap: the dashboard's app iframe has no allow="geolocation", so the in-dashboard launch path won't get location access either until that shared component is patched.
2026-08-05 13:41:38 +00:00
parent 8286156412
commit 0bf9b8997c
2 changed files with 74 additions and 0 deletions
@@ -0,0 +1,27 @@
+server {
+    listen 8543 ssl;
+    listen [::]:8543 ssl;
+    server_name _;
+
+    ssl_certificate /etc/archipelago/ssl/archipelago.crt;
+    ssl_certificate_key /etc/archipelago/ssl/archipelago.key;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
+
+    # Regress needs browser geolocation for its core claim/link mechanic — the
+    # main archipelago dashboard's server blocks (80/443) set
+    # Permissions-Policy: geolocation=() globally, which would silently break
+    # this feature if Regress were proxied under those. This is a dedicated
+    # server block on its own port specifically so it isn't subject to that.
+    add_header Permissions-Policy "geolocation=(self)" always;
+    add_header X-Content-Type-Options "nosniff" always;
+
+    location / {
+        proxy_pass http://127.0.0.1:8199;
+        proxy_http_version 1.1;
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+    }
+}