soroushdes/flatrender
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(deploy): sync nginx/cert/DNS docs with the real working setup
CI/CD / CI · Web (tsc) (push) Successful in 1m12s
Details
CI/CD / Deploy · full stack (push) Has been cancelled
Details

Browse Source 
Reflect what the live deploy actually required:
- cert must be NESTED under an already-mounted dir (/etc/ssl/soroushasadi/flatrender/)
  — mirror-nginx mounts cert dirs individually, so a fresh /etc/ssl/flatrender is
  invisible in the container.
- after a sed -i edit of the bind-mounted nginx.conf, restart (not reload) — inode swap.
- DNS: box is behind NAT (171.22.25.73 private; public via edge/CDN 185.239.1.100 or
  direct 31.171.101.x) — register the domain the same way the other sites enter.
- local SNI test command to verify routing bypassing DNS.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
soroush.asadi
2026-06-15 10:46:32 +03:30
parent 514cd3705f
commit 1106c03feb
2 changed files with 50 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/mirror-nginx-flatrender.conf
+26 -10
View File
@@ -4,11 +4,27 @@
# Routes the three public domains to the FlatRender host ports on 171.22.25.73
# (FRONTEND_PORT / GATEWAY_PORT / MINIO_PORT from the deploy ENV_FILE).
#
# TLS cert must exist first: /etc/ssl/flatrender/{fullchain.pem,privateKey.pem}
# covering flatrender.ir + api.flatrender.ir + storage.flatrender.ir
# (wildcard *.flatrender.ir + apex, or a SAN cert).
# The mirror-nginx config file lives on the HOST at /root/mirror-server/nginx/nginx.conf
# (bind-mounted read-only into the container). Add these blocks there.
#
# Apply: docker exec mirror-nginx nginx -t && docker exec mirror-nginx nginx -s reload
# ⚠️ CERT-MOUNT TRAP: mirror-nginx mounts cert dirs INDIVIDUALLY
# (/etc/ssl/{soroushasadi,meezi,...}). A new /etc/ssl/soroushasadi/flatrender/ on the host is
# INVISIBLE inside the container → nginx -t "cannot load certificate". So NEST the
# flatrender cert under an already-mounted dir:
# mkdir -p /etc/ssl/soroushasadi/flatrender
# cp <cert>/fullchain.pem <cert>/privateKey.pem /etc/ssl/soroushasadi/flatrender/
# The cert must cover flatrender.ir + api. + storage. (wildcard *.flatrender.ir + apex,
# or a SAN cert).
#
# ⚠️ After editing nginx.conf with `sed -i` (which replaces the file inode), the
# running container keeps the OLD inode → you must RESTART, not just reload:
# docker restart mirror-nginx # ~3s blip for all sites
# A plain edit that keeps the inode + reload is fine:
# docker exec mirror-nginx nginx -t && docker exec mirror-nginx nginx -s reload
#
# Test routing locally (bypasses DNS):
# curl -sk --resolve flatrender.ir:443:127.0.0.1 https://flatrender.ir/ | head -c 60
# # must show: <!DOCTYPE html><html lang="fa" dir="rtl">
# ==========================================================================
server {
@@ -22,8 +38,8 @@ server {
listen 443 ssl; http2 on;
server_name flatrender.ir www.flatrender.ir;
client_max_body_size 25m;
ssl_certificate /etc/ssl/flatrender/fullchain.pem;
ssl_certificate_key /etc/ssl/flatrender/privateKey.pem;
ssl_certificate /etc/ssl/soroushasadi/flatrender/fullchain.pem;
ssl_certificate_key /etc/ssl/soroushasadi/flatrender/privateKey.pem;
location / {
proxy_pass http://171.22.25.73:1600;
proxy_http_version 1.1;
@@ -41,8 +57,8 @@ server {
listen 443 ssl; http2 on;
server_name api.flatrender.ir;
client_max_body_size 512m; # large uploads routed through the gateway
ssl_certificate /etc/ssl/flatrender/fullchain.pem;
ssl_certificate_key /etc/ssl/flatrender/privateKey.pem;
ssl_certificate /etc/ssl/soroushasadi/flatrender/fullchain.pem;
ssl_certificate_key /etc/ssl/soroushasadi/flatrender/privateKey.pem;
location / {
proxy_pass http://171.22.25.73:1605;
proxy_http_version 1.1;
@@ -61,8 +77,8 @@ server {
listen 443 ssl; http2 on;
server_name storage.flatrender.ir;
client_max_body_size 512m;
ssl_certificate /etc/ssl/flatrender/fullchain.pem;
ssl_certificate_key /etc/ssl/flatrender/privateKey.pem;
ssl_certificate /etc/ssl/soroushasadi/flatrender/fullchain.pem;
ssl_certificate_key /etc/ssl/soroushasadi/flatrender/privateKey.pem;
location / {
proxy_pass http://171.22.25.73:1610;
proxy_set_header Host $host;