Support flexible base paths and thin proxies

proxy/.env.example

@@ -0,0 +1,6 @@
+AISHARE_PROXY_BIND=127.0.0.1:8090
+AISHARE_PROXY_SERVER_NAME=_
+AISHARE_PROXY_EXTERNAL_PATH=/aishare
+AISHARE_UPSTREAM_ORIGIN=https://origin.example.com
+AISHARE_UPSTREAM_PATH=/aishare
+AISHARE_PROXY_CLIENT_MAX_BODY_SIZE=20m

proxy/README.md

@@ -0,0 +1,62 @@
+# AI Share Thin Proxy
+
+This compose stack runs only nginx and forwards an external hostname/path to an existing AI Share origin. It is intended for small servers where the browser-facing URL may be different from the origin URL.
+
+The origin service should keep a stable internal mount, usually:
+
+```env
+AISHARE_BASE_PATH=/aishare
+```
+
+The proxy can expose that same origin as any hostname/path because reader pages use relative links and the admin UI derives API/share URLs from the browser's current URL.
+
+## Prefix Proxy
+
+Example: expose `https://domain.com/services/aishare/` and forward to an origin mounted at `/aishare`.
+
+```bash
+cd proxy
+cp .env.example .env
+```
+
+```env
+AISHARE_PROXY_BIND=127.0.0.1:8090
+AISHARE_PROXY_SERVER_NAME=domain.com
+AISHARE_PROXY_EXTERNAL_PATH=/services/aishare
+AISHARE_UPSTREAM_ORIGIN=https://origin.example.com
+AISHARE_UPSTREAM_PATH=/aishare
+```
+
+```bash
+docker compose up -d
+```
+
+Point the server's edge nginx at `http://127.0.0.1:8090`.
+
+## Root Host Proxy
+
+Example: expose `https://aishare.domain.com/` and forward to an origin mounted at `/aishare`.
+
+```env
+AISHARE_PROXY_BIND=127.0.0.1:8090
+AISHARE_PROXY_SERVER_NAME=aishare.domain.com
+AISHARE_PROXY_EXTERNAL_PATH=/
+AISHARE_UPSTREAM_ORIGIN=https://origin.example.com
+AISHARE_UPSTREAM_PATH=/aishare
+```
+
+## Direct Serving
+
+If this service is not behind a rewriting proxy, set the app mount directly:
+
+```env
+AISHARE_BASE_PATH=/
+```
+
+or:
+
+```env
+AISHARE_BASE_PATH=/services/aishare
+```
+
+Then route traffic to the AI Share container without path rewriting.

proxy/compose.yml

@@ -0,0 +1,16 @@
+services:
+  aishare-proxy:
+    image: nginx:1.27-alpine
+    container_name: aishare-proxy
+    restart: unless-stopped
+    environment:
+      AISHARE_PROXY_SERVER_NAME: ${AISHARE_PROXY_SERVER_NAME:-_}
+      AISHARE_PROXY_LISTEN: ${AISHARE_PROXY_LISTEN:-8080}
+      AISHARE_PROXY_EXTERNAL_PATH: ${AISHARE_PROXY_EXTERNAL_PATH:-/aishare}
+      AISHARE_UPSTREAM_ORIGIN: ${AISHARE_UPSTREAM_ORIGIN:?set AISHARE_UPSTREAM_ORIGIN, for example https://origin.example.com}
+      AISHARE_UPSTREAM_PATH: ${AISHARE_UPSTREAM_PATH:-/aishare}
+      AISHARE_PROXY_CLIENT_MAX_BODY_SIZE: ${AISHARE_PROXY_CLIENT_MAX_BODY_SIZE:-20m}
+    ports:
+      - "${AISHARE_PROXY_BIND:-127.0.0.1:8090}:${AISHARE_PROXY_LISTEN:-8080}"
+    volumes:
+      - ./nginx/render-aishare-proxy.sh:/docker-entrypoint.d/40-render-aishare-proxy.sh:ro

proxy/nginx/render-aishare-proxy.sh

@@ -0,0 +1,70 @@
+#!/bin/sh
+set -eu
+
+normalize_path() {
+  value="${1:-}"
+  value="/$(printf '%s' "$value" | sed -e 's#^/*##' -e 's#/*$##')"
+  if [ "$value" = "/" ]; then
+    printf ''
+  else
+    printf '%s' "$value"
+  fi
+}
+
+external_path="$(normalize_path "${AISHARE_PROXY_EXTERNAL_PATH:-/aishare}")"
+upstream_path="$(normalize_path "${AISHARE_UPSTREAM_PATH:-/aishare}")"
+upstream_origin="$(printf '%s' "${AISHARE_UPSTREAM_ORIGIN:?set AISHARE_UPSTREAM_ORIGIN}" | sed -e 's#/*$##')"
+listen_port="${AISHARE_PROXY_LISTEN:-8080}"
+server_name="${AISHARE_PROXY_SERVER_NAME:-_}"
+client_max_body_size="${AISHARE_PROXY_CLIENT_MAX_BODY_SIZE:-20m}"
+external_slash="${external_path}/"
+upstream_slash="${upstream_path}/"
+if [ -z "$external_path" ]; then external_slash="/"; fi
+if [ -z "$upstream_path" ]; then upstream_slash="/"; fi
+
+cat > /etc/nginx/conf.d/default.conf <<EOF
+server {
+    listen ${listen_port};
+    server_name ${server_name};
+
+    client_max_body_size ${client_max_body_size};
+
+    proxy_http_version 1.1;
+    proxy_ssl_server_name on;
+    proxy_set_header Host \$proxy_host;
+    proxy_set_header X-Forwarded-Host \$http_host;
+    proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto \$scheme;
+    proxy_set_header X-Forwarded-Prefix ${external_path:-/};
+    proxy_set_header X-Real-Ip \$remote_addr;
+EOF
+
+write_proxy_block() {
+  location_line="$1"
+  rewrite_line="$2"
+  cat >> /etc/nginx/conf.d/default.conf <<EOF
+
+    ${location_line} {
+        ${rewrite_line}
+        proxy_redirect ${upstream_slash} ${external_slash};
+        proxy_redirect ${upstream_origin}${upstream_slash} \$scheme://\$http_host${external_slash};
+        proxy_pass ${upstream_origin};
+    }
+EOF
+}
+
+if [ -z "$external_path" ]; then
+  write_proxy_block "location /" "rewrite ^/(.*)\$ ${upstream_path}/\$1 break;"
+else
+  cat >> /etc/nginx/conf.d/default.conf <<EOF
+
+    location = ${external_path} {
+        return 301 ${external_path}/;
+    }
+EOF
+  write_proxy_block "location ^~ ${external_path}/" "rewrite ^${external_path}/?(.*)\$ ${upstream_path}/\$1 break;"
+fi
+
+cat >> /etc/nginx/conf.d/default.conf <<'EOF'
+}
+EOF