From 7c25a6a62eae89436cce58bb4ec2fd56b3bf725b Mon Sep 17 00:00:00 2001 From: shad Date: Sun, 14 Jun 2026 20:37:41 +0400 Subject: [PATCH] fix(nginx): lazy DNS for /api and /internal/canvas-llm upstreams When the K3s node recovers from an outage, cluster DNS (CoreDNS at 10.43.0.10) can be briefly unavailable, and nginx's startup-time resolution of demo.flow-master.ai + canvas-llm-proxy.demo.svc... fails the conf check, leaving the pod in CrashLoopBackOff. The hostnames sat in proxy_pass directives that nginx resolves at boot. Switched to: - resolver 10.43.0.10 valid=30s ipv6=off; - set $upstream_demo / $upstream_llm; proxy_pass $variable; This forces lazy per-request DNS so transient cluster-DNS hiccups don't kill the canvas-frontend pod. Verified during a real K3s node outage today. --- nginx.conf | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/nginx.conf b/nginx.conf index c4554f7..bac771e 100644 --- a/nginx.conf +++ b/nginx.conf @@ -19,9 +19,16 @@ server { add_header Cross-Origin-Resource-Policy "same-origin" always; add_header X-Robots-Tag "noindex, nofollow" always; + # Use the cluster CoreDNS resolver so upstream hostnames are resolved + # lazily (per-request), not at nginx startup. The proxy_pass targets below + # use $variable form to force this lazy resolution; otherwise nginx fails + # to start when cluster DNS is briefly unavailable (e.g. node recovery). + resolver 10.43.0.10 valid=30s ipv6=off; + # Reverse-proxy /api to the demo backend so live mode is same-origin. location /api/ { - proxy_pass https://demo.flow-master.ai; + set $upstream_demo "https://demo.flow-master.ai"; + proxy_pass $upstream_demo; proxy_set_header Host demo.flow-master.ai; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-Host $host; @@ -35,7 +42,8 @@ server { # In-cluster LLM proxy. Returns 503 when no provider key is configured, # so the frontend's deterministic fallback fires gracefully. location /internal/canvas-llm/ { - proxy_pass http://canvas-llm-proxy.demo.svc.cluster.local:8080; + set $upstream_llm "http://canvas-llm-proxy.demo.svc.cluster.local:8080"; + proxy_pass $upstream_llm; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto https; proxy_http_version 1.1;