soroush.asadi
1106c03feb
Reflect what the live deploy actually required: - cert must be NESTED under an already-mounted dir (/etc/ssl/soroushasadi/flatrender/) — mirror-nginx mounts cert dirs individually, so a fresh /etc/ssl/flatrender is invisible in the container. - after a sed -i edit of the bind-mounted nginx.conf, restart (not reload) — inode swap. - DNS: box is behind NAT (171.22.25.73 private; public via edge/CDN 185.239.1.100 or direct 31.171.101.x) — register the domain the same way the other sites enter. - local SNI test command to verify routing bypassing DNS. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
90 lines
4.2 KiB
Plaintext
90 lines
4.2 KiB
Plaintext
# ==========================================================================
|
|
# FlatRender — flatrender.ir (add inside the http{} block of mirror-nginx)
|
|
#
|
|
# Routes the three public domains to the FlatRender host ports on 171.22.25.73
|
|
# (FRONTEND_PORT / GATEWAY_PORT / MINIO_PORT from the deploy ENV_FILE).
|
|
#
|
|
# The mirror-nginx config file lives on the HOST at /root/mirror-server/nginx/nginx.conf
|
|
# (bind-mounted read-only into the container). Add these blocks there.
|
|
#
|
|
# ⚠️ CERT-MOUNT TRAP: mirror-nginx mounts cert dirs INDIVIDUALLY
|
|
# (/etc/ssl/{soroushasadi,meezi,...}). A new /etc/ssl/soroushasadi/flatrender/ on the host is
|
|
# INVISIBLE inside the container → nginx -t "cannot load certificate". So NEST the
|
|
# flatrender cert under an already-mounted dir:
|
|
# mkdir -p /etc/ssl/soroushasadi/flatrender
|
|
# cp <cert>/fullchain.pem <cert>/privateKey.pem /etc/ssl/soroushasadi/flatrender/
|
|
# The cert must cover flatrender.ir + api. + storage. (wildcard *.flatrender.ir + apex,
|
|
# or a SAN cert).
|
|
#
|
|
# ⚠️ After editing nginx.conf with `sed -i` (which replaces the file inode), the
|
|
# running container keeps the OLD inode → you must RESTART, not just reload:
|
|
# docker restart mirror-nginx # ~3s blip for all sites
|
|
# A plain edit that keeps the inode + reload is fine:
|
|
# docker exec mirror-nginx nginx -t && docker exec mirror-nginx nginx -s reload
|
|
#
|
|
# Test routing locally (bypasses DNS):
|
|
# curl -sk --resolve flatrender.ir:443:127.0.0.1 https://flatrender.ir/ | head -c 60
|
|
# # must show: <!DOCTYPE html><html lang="fa" dir="rtl">
|
|
# ==========================================================================
|
|
|
|
server {
|
|
listen 80;
|
|
server_name flatrender.ir www.flatrender.ir api.flatrender.ir storage.flatrender.ir;
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
|
|
# ── Site (Next.js frontend → FRONTEND_PORT) ───────────────────────────────
|
|
server {
|
|
listen 443 ssl; http2 on;
|
|
server_name flatrender.ir www.flatrender.ir;
|
|
client_max_body_size 25m;
|
|
ssl_certificate /etc/ssl/soroushasadi/flatrender/fullchain.pem;
|
|
ssl_certificate_key /etc/ssl/soroushasadi/flatrender/privateKey.pem;
|
|
location / {
|
|
proxy_pass http://171.22.25.73:1600;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
}
|
|
}
|
|
|
|
# ── API gateway (→ GATEWAY_PORT) ──────────────────────────────────────────
|
|
server {
|
|
listen 443 ssl; http2 on;
|
|
server_name api.flatrender.ir;
|
|
client_max_body_size 512m; # large uploads routed through the gateway
|
|
ssl_certificate /etc/ssl/soroushasadi/flatrender/fullchain.pem;
|
|
ssl_certificate_key /etc/ssl/soroushasadi/flatrender/privateKey.pem;
|
|
location / {
|
|
proxy_pass http://171.22.25.73:1605;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header Upgrade $http_upgrade; # render-progress WebSocket
|
|
proxy_set_header Connection $connection_upgrade;
|
|
proxy_read_timeout 3600s;
|
|
}
|
|
}
|
|
|
|
# ── MinIO storage (→ MINIO_PORT) ──────────────────────────────────────────
|
|
server {
|
|
listen 443 ssl; http2 on;
|
|
server_name storage.flatrender.ir;
|
|
client_max_body_size 512m;
|
|
ssl_certificate /etc/ssl/soroushasadi/flatrender/fullchain.pem;
|
|
ssl_certificate_key /etc/ssl/soroushasadi/flatrender/privateKey.pem;
|
|
location / {
|
|
proxy_pass http://171.22.25.73:1610;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
}
|