v1

deploy/fileshare.service

@@ -0,0 +1,31 @@
+# /etc/systemd/system/fileshare.service
+# Adjust User, WorkingDirectory and ExecStart paths to your install.
+#
+#   sudo cp deploy/fileshare.service /etc/systemd/system/
+#   sudo systemctl daemon-reload
+#   sudo systemctl enable --now fileshare
+#   sudo journalctl -u fileshare -f
+
+[Unit]
+Description=One-Time File Share
+After=network.target mysqld.service
+Wants=mysqld.service
+
+[Service]
+Type=simple
+User=fileshare
+Group=fileshare
+WorkingDirectory=/opt/fileshare
+EnvironmentFile=/opt/fileshare/.env
+ExecStart=/usr/bin/node src/server.js
+Restart=always
+RestartSec=3
+
+# Hardening
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=full
+ReadWritePaths=/opt/fileshare/data
+
+[Install]
+WantedBy=multi-user.target

deploy/nginx-fileShare.conf

@@ -0,0 +1,25 @@
+# Add this inside the `server { ... }` block of your existing HTTPS vhost.
+# The app mounts itself at /fileShare, so we must PRESERVE the path prefix —
+# note there is no trailing slash / path on proxy_pass.
+
+# Make the bare path (no trailing slash) redirect into the app.
+location = /fileShare {
+    return 301 /fileShare/;
+}
+
+location /fileShare/ {
+    proxy_pass http://127.0.0.1:8077;
+
+    proxy_set_header Host              $host;
+    proxy_set_header X-Real-IP         $remote_addr;
+    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+
+    # Must be >= MAX_UPLOAD_BYTES in .env (here: 4 GiB).
+    client_max_body_size 4096m;
+
+    # Stream large uploads straight to the app instead of buffering to disk first.
+    proxy_request_buffering off;
+    proxy_read_timeout 600s;
+    proxy_send_timeout 600s;
+}