# ========================================================================== # FlatRender — flatrender.ir (add inside the http{} block of mirror-nginx) # # Routes the three public domains to the FlatRender host ports on 171.22.25.73 # (FRONTEND_PORT / GATEWAY_PORT / MINIO_PORT from the deploy ENV_FILE). # # The mirror-nginx config file lives on the HOST at /root/mirror-server/nginx/nginx.conf # (bind-mounted read-only into the container). Add these blocks there. # # ⚠️ CERT-MOUNT TRAP: mirror-nginx mounts cert dirs INDIVIDUALLY # (/etc/ssl/{soroushasadi,meezi,...}). A new /etc/ssl/soroushasadi/flatrender/ on the host is # INVISIBLE inside the container → nginx -t "cannot load certificate". So NEST the # flatrender cert under an already-mounted dir: # mkdir -p /etc/ssl/soroushasadi/flatrender # cp /fullchain.pem /privateKey.pem /etc/ssl/soroushasadi/flatrender/ # The cert must cover flatrender.ir + api. + storage. (wildcard *.flatrender.ir + apex, # or a SAN cert). # # ⚠️ After editing nginx.conf with `sed -i` (which replaces the file inode), the # running container keeps the OLD inode → you must RESTART, not just reload: # docker restart mirror-nginx # ~3s blip for all sites # A plain edit that keeps the inode + reload is fine: # docker exec mirror-nginx nginx -t && docker exec mirror-nginx nginx -s reload # # Test routing locally (bypasses DNS): # curl -sk --resolve flatrender.ir:443:127.0.0.1 https://flatrender.ir/ | head -c 60 # # must show: # ========================================================================== server { listen 80; server_name flatrender.ir www.flatrender.ir api.flatrender.ir storage.flatrender.ir; return 301 https://$host$request_uri; } # ── Site (Next.js frontend → FRONTEND_PORT) ─────────────────────────────── server { listen 443 ssl; http2 on; server_name flatrender.ir www.flatrender.ir; client_max_body_size 25m; ssl_certificate /etc/ssl/soroushasadi/flatrender/fullchain.pem; ssl_certificate_key /etc/ssl/soroushasadi/flatrender/privateKey.pem; location / { proxy_pass http://171.22.25.73:1600; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; } } # ── API gateway (→ GATEWAY_PORT) ────────────────────────────────────────── server { listen 443 ssl; http2 on; server_name api.flatrender.ir; client_max_body_size 512m; # large uploads routed through the gateway ssl_certificate /etc/ssl/soroushasadi/flatrender/fullchain.pem; ssl_certificate_key /etc/ssl/soroushasadi/flatrender/privateKey.pem; location / { proxy_pass http://171.22.25.73:1605; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header Upgrade $http_upgrade; # render-progress WebSocket proxy_set_header Connection $connection_upgrade; proxy_read_timeout 3600s; } } # ── MinIO storage (→ MINIO_PORT) ────────────────────────────────────────── server { listen 443 ssl; http2 on; server_name storage.flatrender.ir; client_max_body_size 512m; ssl_certificate /etc/ssl/soroushasadi/flatrender/fullchain.pem; ssl_certificate_key /etc/ssl/soroushasadi/flatrender/privateKey.pem; location / { proxy_pass http://171.22.25.73:1610; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } }