The nginx sidecar gets data, config and /var/www/tmp mounted, and I can't work out what it uses them for.
The default server block already refuses both paths (files/nginx.config.tpl):
location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/) { return 404; }
That's a regex location declared before the static file ones, so it matches first and nginx never touches the filesystem for those URLs. And /var/www/tmp sits outside root /var/www/html, so it isn't reachable at all.
Am I missing a case where nginx actually needs to read them? Asking partly because #816 is adding a dataVolumeMount flag that also applies to the nginx container, and if the mount is never used there then it does not need the flag either. Dropping the three mounts would also mean the internet-facing container no longer has the user data directory attached, and would sidestep the /var/www/html/config ownership trouble in #335.
The nginx sidecar gets
data,configand/var/www/tmpmounted, and I can't work out what it uses them for.The default server block already refuses both paths (
files/nginx.config.tpl):location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/) { return 404; }That's a regex location declared before the static file ones, so it matches first and nginx never touches the filesystem for those URLs. And
/var/www/tmpsits outsideroot /var/www/html, so it isn't reachable at all.Am I missing a case where nginx actually needs to read them? Asking partly because #816 is adding a
dataVolumeMountflag that also applies to the nginx container, and if the mount is never used there then it does not need the flag either. Dropping the three mounts would also mean the internet-facing container no longer has the user data directory attached, and would sidestep the/var/www/html/configownership trouble in #335.