@askexenow/exe-os 0.9.407 → 0.9.409

package/deploy/compose/erp-nginx/nginx.conf

@@ -32,6 +32,9 @@ server {
     location /assets/ {
         proxy_pass http://$erp_backend;
         proxy_set_header Host $host;
+        # Frappe prioritizes this header over Host. Never pass a caller's
+        # selector through to another company site on a shared bench.
+        proxy_set_header X-Frappe-Site-Name $host;
         proxy_set_header X-Real-IP $remote_addr;
         expires 1y;
         add_header Cache-Control "public, immutable";
@@ -39,8 +42,9 @@ server {
 
     # Uploaded files
     location /files/ {
-        alias /home/frappe/frappe-bench/sites/;
-        try_files /$host/public/files/$uri =404;
+        root /home/frappe/frappe-bench/sites;
+        # $uri already starts with /files/. Match only this Host's public tree.
+        try_files /$host/public$uri =404;
     }
 
     # Socket.IO
@@ -50,6 +54,7 @@ server {
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection "upgrade";
         proxy_set_header Host $host;
+        proxy_set_header X-Frappe-Site-Name $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
@@ -60,6 +65,7 @@ server {
         proxy_pass http://$erp_backend;
         proxy_http_version 1.1;
         proxy_set_header Host $host;
+        proxy_set_header X-Frappe-Site-Name $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;

package/deploy/compose/sso-edge/default.conf.template

@@ -1,3 +1,8 @@
+map "$host:$arg_demo" $exe_demo_navigation_cookie {
+    default "";
+    "crm.${DOMAIN}:1" "exe_selected_org=demo; Domain=.${DOMAIN}; Path=/; Secure; SameSite=Lax";
+}
+
 # ─────────────────────────────────────────────────────────────────────────────
 # Unified SSO edge — reverse proxy in front of crm / wiki / erp  (bug 96f8b2b2)
 #
@@ -137,6 +142,10 @@ server {
     listen 80;
     server_name crm.${DOMAIN};
 
+    # CRM's supported demo join marks its normal verify URL with demo=1.
+    # This cookie selects navigation, never identity or membership.
+    add_header Set-Cookie $exe_demo_navigation_cookie always;
+
     set $sso_auth_base      "https://auth.${DOMAIN}";
     set $sso_app_url        "https://crm.${DOMAIN}";
     set $sso_product        "CRM";
@@ -193,6 +202,13 @@ server {
     listen 80;
     server_name wiki.${DOMAIN};
 
+    # Noncredential selection changes navigation only. The destination still
+    # validates central identity and its own isolated DEMO permissions.
+    location = / {
+        if ($cookie_exe_selected_org = "demo") { return 302 https://demo-wiki.${DOMAIN}/; }
+        proxy_pass http://$wiki_upstream;
+    }
+
     set $sso_auth_base      "https://auth.${DOMAIN}";
     set $sso_app_url        "https://wiki.${DOMAIN}";
     set $sso_product        "Wiki";
@@ -258,6 +274,13 @@ server {
     listen 80;
     server_name erp.${DOMAIN};
 
+    # Noncredential selection changes navigation only. The destination still
+    # validates central identity and its own isolated DEMO permissions.
+    location = / {
+        if ($cookie_exe_selected_org = "demo") { return 302 https://demo-erp.${DOMAIN}/; }
+        proxy_pass http://$erp_upstream;
+    }
+
     set $sso_auth_base      "https://auth.${DOMAIN}";
     set $sso_app_url        "https://erp.${DOMAIN}";
     set $sso_product        "ERP";
@@ -346,6 +369,38 @@ server {
     location / { proxy_pass http://$dashboard_upstream; }
 }
 
+# Isolated public DEMO Wiki — same central Auth, separate product data.
+server {
+    listen 80;
+    server_name demo-wiki.${DOMAIN};
+    set $sso_auth_base "https://auth.${DOMAIN}";
+    set $sso_app_url "https://demo-wiki.${DOMAIN}";
+    set $sso_product "Wiki";
+    set $sso_session_cookie "";
+    set $demo_upstream exe-demo-wiki:3001;
+    set $gotrue_upstream gotrue:9999;
+    include /etc/nginx/snippets/sso-redirect.conf;
+    add_header Set-Cookie "exe_selected_org=demo; Domain=.${DOMAIN}; Path=/; Secure; SameSite=Lax" always;
+    location = /__version { auth_request off; proxy_pass http://$demo_upstream/__version; }
+    location / { proxy_pass http://$demo_upstream; }
+}
+
+# Isolated public DEMO ERP — same central Auth, separate product data.
+server {
+    listen 80;
+    server_name demo-erp.${DOMAIN};
+    set $sso_auth_base "https://auth.${DOMAIN}";
+    set $sso_app_url "https://demo-erp.${DOMAIN}";
+    set $sso_product "ERP";
+    set $sso_session_cookie $cookie_sid;
+    set $demo_upstream exe-erp-nginx:80;
+    set $gotrue_upstream gotrue:9999;
+    include /etc/nginx/snippets/sso-redirect.conf;
+    add_header Set-Cookie "exe_selected_org=demo; Domain=.${DOMAIN}; Path=/; Secure; SameSite=Lax" always;
+    location = /__version { auth_request off; proxy_pass http://$demo_upstream/__version; }
+    location / { proxy_pass http://$demo_upstream; }
+}
+
 # Default — unknown host or edge-generated error → branded shared error pages
 # (packages/exe-error-pages, vendored here by packages/exe-error-pages/sync.mjs
 # and bind-mounted at /usr/share/nginx/html/error-pages; bug 64324162 delivery

package/deploy/hosted/public-demo-compose.yml

@@ -0,0 +1,52 @@
+# Additive DEMO provisioning. No private Exe volumes or credentials are reused.
+# WIKI_DEMO_IMAGE is verified against a normal published signed stack release.
+name: exe-public-demo
+services:
+  wiki:
+    image: ${WIKI_DEMO_IMAGE:?verified signed Wiki digest required}
+    container_name: exe-demo-wiki
+    restart: unless-stopped
+    user: exe-wiki
+    cap_drop: [ALL]
+    security_opt: [no-new-privileges:true]
+    env_file: ./wiki-demo.env
+    environment:
+      NODE_ENV: production
+      SERVER_PORT: "3001"
+      STORAGE_DIR: /app/server/storage
+      EXE_ORG_ID: demo
+      WIKI_PUBLIC_DEMO: "true"
+      WIKI_REQUIRE_MANAGED_PERMS: "true"
+      WIKI_DEMO_DATABASE: exe_demo_wiki
+      GOTRUE_URL: http://gotrue:9999
+      GOTRUE_EXTERNAL_URL: https://auth.${DOMAIN:?existing apex required}
+      GOTRUE_JWT_ISSUER: https://auth.${DOMAIN}
+      VECTOR_DB: pgvector
+      PGVECTOR_TABLE_NAME: exe_demo_wiki_vectors
+      EXE_WIKI_CHROMIUM_ARGS: --no-sandbox,--disable-setuid-sandbox
+    volumes:
+      - wiki_demo_storage:/app/server/storage
+    networks: [backend,frontend]
+    ports: ["127.0.0.1:3002:3001"]
+    healthcheck:
+      test: [CMD,bash,/usr/local/bin/docker-healthcheck.sh]
+      interval: 30s
+      timeout: 10s
+      start_period: 90s
+      retries: 5
+    deploy:
+      resources:
+        limits: {memory: 2G, cpus: "2"}
+    logging:
+      driver: json-file
+      options: {max-size: 10m, max-file: "3"}
+volumes:
+  wiki_demo_storage:
+    name: exe-public-demo_wiki_storage
+networks:
+  backend:
+    external: true
+    name: exe-os_backend
+  frontend:
+    external: true
+    name: exe-os_frontend