From a5759491d092c47c03f0acda629c502298b8c695 Mon Sep 17 00:00:00 2001 From: Doxa Maps Date: Sun, 27 Sep 2026 21:53:03 +0000 Subject: [PATCH] Cloud container: RUDDER_ALLOW_HOST (the public host Rudder's engine accepts), defaulting to OIDC_REDIRECT_URL's host; 2 vCPUs advised The engine now refuses non-loopback Host headers and Vite's proxy passes the public host through, so without this every /api/rudder call is 403 (studio, RUDSRV-STU2). entry.sh derives it from OIDC_REDIRECT_URL when unset; the README documents it and the CPU need (it ran ~1.5x behind real time on a loaded box). --- deployment/cloud/README.md | 3 ++- deployment/cloud/entry.sh | 6 ++++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/deployment/cloud/README.md b/deployment/cloud/README.md index 74736f8ea..e5f0c1d3d 100644 --- a/deployment/cloud/README.md +++ b/deployment/cloud/README.md @@ -67,7 +67,8 @@ there. Only then does it swap the new build in. | `PB_SUPERUSER_EMAIL`, `PB_SUPERUSER_PASSWORD` | PocketBase's superuser, set on start in both instances | | `PUBLIC_API_BASE` | the public API URL written into the build's `runtime-config.js` (e.g. `https:///api-prod`) | | `BUILD_MAX_OLD_SPACE_MB` | Node heap cap for a build (default `1536`) | -| `RUDDER_ENGINE` | `1` runs Rudder's voice-to-text engine here, fed by the browser's microphone (about 1 GB more; its model, ~742 MB, downloads once to `RUDDER_HOME`, default `/data/rudder`) | +| `RUDDER_ENGINE` | `1` runs Rudder's voice-to-text engine here, fed by the browser's microphone (about 1 GB more; its model, ~742 MB, downloads once to `RUDDER_HOME`, default `/data/rudder`). Give the container at least 2 vCPUs, or transcription falls behind speech | +| `RUDDER_ALLOW_HOST` | the public host the engine accepts (it refuses others); defaults to the host in `OIDC_REDIRECT_URL` | Mount a persistent volume at **`/data`** (PocketBase data and published builds). Memory measured on the running container: about 0.45 GB idle, up to about 1.5 GB more during a build, so give it diff --git a/deployment/cloud/entry.sh b/deployment/cloud/entry.sh index 1e9525db0..7f2e64ec3 100755 --- a/deployment/cloud/entry.sh +++ b/deployment/cloud/entry.sh @@ -36,6 +36,12 @@ CONFIG=/app/repo/deployment/cloud/vite.cloud.config.mjs # /api/rudder, which stays behind the sign-in (it is not a public route). About 1 GB resident. if [ "${RUDDER_ENGINE:-0}" = 1 ]; then export RUDDER_HOME="${RUDDER_HOME:-/data/rudder}" RUDDER_AUDIO=browser + # The engine refuses a non-loopback Host header, and Vite's proxy passes the public host through: + # allow the public host, defaulting to the one in OIDC_REDIRECT_URL. + if [ -z "${RUDDER_ALLOW_HOST:-}" ] && [ -n "${OIDC_REDIRECT_URL:-}" ]; then + RUDDER_ALLOW_HOST=$(printf '%s' "$OIDC_REDIRECT_URL" | sed -E 's#^[a-z]+://([^/:]+).*#\1#') + fi + export RUDDER_ALLOW_HOST="${RUDDER_ALLOW_HOST:-}" bash /app/repo/backend/rudder-engine/setup-runtime.sh \ || echo "[rudder] setup failed: the widget will report the engine offline" fi