関係リポジトリ

インフラ（本番環境デプロイを簡単にするツール） https://github.com/ShioPy0101/mitsubachi-infra

開発ツール（開発環境を簡単に立てれるツール） https://github.com/ShioPy0101/mitsubachi-devkit

フロントエンド https://github.com/ShioPy0101/mitsubachi-front

Mitsubachi Rails API

Rails backend for the drive API. This repository is deployed as an API-only server; the frontend lives in a separate repository and process.

Runtime

• Ruby: see .ruby-version
• Bundler: use the version bundled with the project lockfile
• Database: PostgreSQL
• Web server: Puma behind Caddy or Nginx
• Public frontend origin: https://mitsubachi.shiosalt.com/
• Public API origin: https://mitsubachi-api.shiosalt.com/
• API base path: /api/v1
• Health checks: /api/health/live, /api/health/ready

Rails should bind only to a private interface such as 127.0.0.1:3000. Do not expose the Rails port directly to the internet.

Required Environment

APP_HOST=mitsubachi-api.shiosalt.com
APP_HOSTS=mitsubachi-api.shiosalt.com
FRONTEND_ORIGIN=https://mitsubachi.shiosalt.com
RAILS_MASTER_KEY=...
DATABASE_URL=postgres://...
FILE_STORAGE_ROOT=/srv/mitsubachi/files
MAX_UPLOAD_SIZE_BYTES=10737418240
RAILS_LOG_LEVEL=info
SECRET_KEY_BASE=...
RESEND_API_KEY=...
MAIL_FROM=...
FRONTEND_URL=https://mitsubachi.shiosalt.com

FRONTEND_ORIGIN is a comma-separated allowlist used by API CORS in every environment. Set it to the browser-visible frontend origin, not the API origin.

Setup

sudo service postgresql start
pg_isready
bin/setup
bin/rails db:prepare

Create the file storage directory before starting Rails:

sudo mkdir -p /srv/mitsubachi/files/drive_items
sudo chown -R rails:rails /srv/mitsubachi/files
sudo chmod 750 /srv/mitsubachi/files /srv/mitsubachi/files/drive_items

Use the actual service user instead of rails if it differs.

Run

Development:

bin/rails server -b 127.0.0.1 -p 3000

Production example:

RAILS_ENV=production bin/rails server -b 127.0.0.1 -p 3000

Reverse Proxy Contract

• / is served by the frontend server.
• /api/* is proxied to Rails.
• The Rails internal port is not publicly reachable.
• Preserve the original Host header.
• Pass X-Forwarded-Proto.
• Configure upload limits at the proxy to be at least MAX_UPLOAD_SIZE_BYTES.
• Configure timeouts for large uploads and downloads.
• For protected file delivery, this Rails app currently emits X-Accel-Redirect; use Nginx or an equivalent internal delivery layer that supports that contract.

Minimal Nginx sketch:

server {
  server_name mitsubachi-api.shiosalt.com;

  location /api/ {
    proxy_pass http://127.0.0.1:3000;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    client_max_body_size 10G;
  }

  location /internal/storage/ {
    internal;
    alias /srv/mitsubachi/files/;
  }

  # The frontend is served separately from https://mitsubachi.shiosalt.com.
}

Caddy can terminate TLS and proxy /api/* to Rails, but X-Accel-Redirect is Nginx-specific. If Caddy is used as the public proxy, keep Nginx or another internal file delivery mechanism in front of protected storage.

Security Notes

• Authentication uses Devise Cookie sessions.
• Production cookies are Secure, HttpOnly, and SameSite=Lax.
• Login verification regenerates the session.
• CSRF protection is enabled for browser state-changing requests.
• Production Host Authorization allows APP_HOST and does not clear host checks.
• Set APP_HOSTS to the comma-separated public API hostnames accepted by Host Authorization.
• config.force_ssl is enabled in production with reverse proxy TLS termination.
• Public magic-link endpoints are rate limited by IP and email to reduce abuse from internet exposure.
• CSRF failures return JSON 422 and reset the session.
• File paths are derived from generated storage_key values, not user filenames.
• Content-Type is detected with Marcel and does not rely only on the client declaration.

Tests

bin/ai-check
bin/check

The API contract is maintained as OpenAPI YAML in docs/api.yml. bin/ai-check and bin/check run bin/check-api-spec, which fails when Rails API routes and the YAML paths diverge.

Backups

Back up PostgreSQL and FILE_STORAGE_ROOT. They must be restored together to keep DriveItem metadata and physical files consistent.

Logs

Production logs go to STDOUT and include Rails request IDs. Do not log passwords, cookies, authorization headers, CSRF tokens, magic link tokens, or file contents.