SA Model Viewer base

deploy/bucket-cors.json

@@ -0,0 +1,8 @@
+[
+  {
+    "AllowedOrigins": ["https://model.southwest-roleplay.dev"],
+    "AllowedMethods": ["GET", "HEAD"],
+    "AllowedHeaders": ["*"],
+    "MaxAgeSeconds": 3600
+  }
+]

deploy/iam-policy.json

@@ -0,0 +1,16 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": "s3:GetObject",
+      "Resource": "arn:aws:s3:::your-bucket/skins/*"
+    },
+    {
+      "Effect": "Allow",
+      "Action": "s3:ListBucket",
+      "Resource": "arn:aws:s3:::your-bucket",
+      "Condition": { "StringLike": { "s3:prefix": "skins/*" } }
+    }
+  ]
+}

deploy/modelviewer.service

@@ -0,0 +1,19 @@
+[Unit]
+Description=GTA:SA model viewer
+After=network.target
+
+[Service]
+Type=simple
+User=www-data
+WorkingDirectory=/var/www/modelviewer
+EnvironmentFile=/etc/modelviewer.env
+ExecStart=/usr/bin/node server.js
+Restart=on-failure
+RestartSec=5
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+
+[Install]
+WantedBy=multi-user.target

deploy/nginx.conf

@@ -0,0 +1,49 @@
+# /etc/nginx/sites-available/model.southwest-roleplay.dev
+#
+# Only /samp/skin/<id> and the assets that page needs are exposed. Everything
+# else, including the root, returns 404. certbot rewrites this for 443 and
+# leaves the location blocks untouched.
+
+server {
+    listen 80;
+    server_name model.southwest-roleplay.dev;
+
+    location /samp/skin/ {
+        proxy_pass http://127.0.0.1:3000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    location /api/skin/ {
+        proxy_pass http://127.0.0.1:3000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    location /js/ {
+        proxy_pass http://127.0.0.1:3000;
+    }
+
+    location /vendor/ {
+        proxy_pass http://127.0.0.1:3000;
+        add_header Cache-Control "public, max-age=31536000, immutable";
+    }
+
+    # Path A only: model files come from S3 through nginx, so they stay
+    # same-origin and no bucket CORS rule is needed. Delete this block if you
+    # set MODELS_BASE_URL and let the browser fetch the CDN directly.
+    location /models/ {
+        proxy_pass https://your-bucket.s3.eu-west-2.amazonaws.com/skins/;
+        proxy_set_header Host your-bucket.s3.eu-west-2.amazonaws.com;
+        proxy_hide_header x-amz-id-2;
+        proxy_hide_header x-amz-request-id;
+        proxy_hide_header x-amz-server-side-encryption;
+        add_header Cache-Control "public, max-age=31536000, immutable";
+    }
+
+    location / {
+        return 404;
+    }
+}