soroush.asadi
12588b65df
The server's central mirror-nginx already owns 80/443 + manages TLS, so FlatRender
can't run its own Caddy there. Adapt the deploy to the host-port + reverse-proxy model:
- compose: Caddy moved behind `profiles: [edge]` (not started by default); frontend/
gateway/minio host ports are now EDGE_BIND + FRONTEND_PORT/GATEWAY_PORT/MINIO_PORT
(so they can avoid Gitea's :3000 etc.); postgres/render stay on HOST_BIND loopback.
- deploy/ENV_FILE.production.example: nginx model, pre-filled for flatrender.ir,
host ports 1600/1605/1610, no Caddy/ACME vars.
- deploy/mirror-nginx-flatrender.conf: ready-to-paste server blocks routing
flatrender.ir / api / storage → 171.22.25.73:{1600,1605,1610}.
- deploy/README.md: nginx integration + cert step.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
74 lines
3.2 KiB
Plaintext
74 lines
3.2 KiB
Plaintext
# ==========================================================================
|
|
# FlatRender — flatrender.ir (add inside the http{} block of mirror-nginx)
|
|
#
|
|
# Routes the three public domains to the FlatRender host ports on 171.22.25.73
|
|
# (FRONTEND_PORT / GATEWAY_PORT / MINIO_PORT from the deploy ENV_FILE).
|
|
#
|
|
# TLS cert must exist first: /etc/ssl/flatrender/{fullchain.pem,privateKey.pem}
|
|
# covering flatrender.ir + api.flatrender.ir + storage.flatrender.ir
|
|
# (wildcard *.flatrender.ir + apex, or a SAN cert).
|
|
#
|
|
# Apply: docker exec mirror-nginx nginx -t && docker exec mirror-nginx nginx -s reload
|
|
# ==========================================================================
|
|
|
|
server {
|
|
listen 80;
|
|
server_name flatrender.ir www.flatrender.ir api.flatrender.ir storage.flatrender.ir;
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
|
|
# ── Site (Next.js frontend → FRONTEND_PORT) ───────────────────────────────
|
|
server {
|
|
listen 443 ssl; http2 on;
|
|
server_name flatrender.ir www.flatrender.ir;
|
|
client_max_body_size 25m;
|
|
ssl_certificate /etc/ssl/flatrender/fullchain.pem;
|
|
ssl_certificate_key /etc/ssl/flatrender/privateKey.pem;
|
|
location / {
|
|
proxy_pass http://171.22.25.73:1600;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
}
|
|
}
|
|
|
|
# ── API gateway (→ GATEWAY_PORT) ──────────────────────────────────────────
|
|
server {
|
|
listen 443 ssl; http2 on;
|
|
server_name api.flatrender.ir;
|
|
client_max_body_size 512m; # large uploads routed through the gateway
|
|
ssl_certificate /etc/ssl/flatrender/fullchain.pem;
|
|
ssl_certificate_key /etc/ssl/flatrender/privateKey.pem;
|
|
location / {
|
|
proxy_pass http://171.22.25.73:1605;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header Upgrade $http_upgrade; # render-progress WebSocket
|
|
proxy_set_header Connection $connection_upgrade;
|
|
proxy_read_timeout 3600s;
|
|
}
|
|
}
|
|
|
|
# ── MinIO storage (→ MINIO_PORT) ──────────────────────────────────────────
|
|
server {
|
|
listen 443 ssl; http2 on;
|
|
server_name storage.flatrender.ir;
|
|
client_max_body_size 512m;
|
|
ssl_certificate /etc/ssl/flatrender/fullchain.pem;
|
|
ssl_certificate_key /etc/ssl/flatrender/privateKey.pem;
|
|
location / {
|
|
proxy_pass http://171.22.25.73:1610;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
}
|