From 07ee1bd9a0f7bd448ebf089f2d21f639bf24edf6 Mon Sep 17 00:00:00 2001 From: Anthony Ettinger Date: Mon, 28 Sep 2026 20:14:07 +0000 Subject: [PATCH] fix(ops): raise nginx proxy_buffer_size for the app and Supabase gateway Supabase SSR auth sets several chunked sb-*-auth-token cookies on sign-in; they overflow nginx's default proxy_buffer_size, which logs "upstream sent too big header" and turns a successful login into a 502. Same fix as the rest of dev2 (cli-tools #112). Applied to the live vhost in place, since certbot owns its TLS lines. Co-Authored-By: Claude Opus 5.5 (1M context) --- ops/selfhost/server/nginx-crawlproof.conf | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/ops/selfhost/server/nginx-crawlproof.conf b/ops/selfhost/server/nginx-crawlproof.conf index 7ff02f3..a4d0e62 100644 --- a/ops/selfhost/server/nginx-crawlproof.conf +++ b/ops/selfhost/server/nginx-crawlproof.conf @@ -47,6 +47,10 @@ server { proxy_send_timeout 300s; proxy_read_timeout 300s; proxy_buffering off; + # Supabase auth cookies overflow the default header buffer (502). + proxy_buffer_size 64k; + proxy_buffers 8 64k; + proxy_busy_buffers_size 128k; } } @@ -86,5 +90,9 @@ server { proxy_send_timeout 3600s; proxy_read_timeout 3600s; proxy_buffering off; + # Supabase auth cookies overflow the default header buffer (502). + proxy_buffer_size 64k; + proxy_buffers 8 64k; + proxy_busy_buffers_size 128k; } }