`deploy/90210.agentabrams.com.nginx`

40 lines
# 90210.agentabrams.com — Beverly Hills 90210 Arcade (Cloudflare-PROXIED origin)
#
# 90210.agentabrams.com stays orange-cloud (proxied) in Cloudflare — the edge
# terminates TLS for the browser. This origin block serves the hub on BOTH :80
# and :443 so it works whether Cloudflare connects over Full (:443) or Flexible
# (:80). No certbot / Let's Encrypt issuance is needed for this host: it REUSES
# the existing games.agentabrams.com certificate, which Cloudflare's proxy
# (Full, non-strict) accepts without hostname validation.
#
# Install:
#   scp deploy/90210.agentabrams.com.nginx root@45.61.58.125:/etc/nginx/sites-available/90210.agentabrams.com
#   ssh root@45.61.58.125 'ln -sf /etc/nginx/sites-available/90210.agentabrams.com /etc/nginx/sites-enabled/ && nginx -t && systemctl reload nginx'
server {
    server_name 90210.agentabrams.com;

    access_log /var/log/nginx/90210.agentabrams.com.access.log;
    error_log  /var/log/nginx/90210.agentabrams.com.error.log;

    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    root /var/www/90210.agentabrams.com;
    index index.html;
    autoindex off;

    location / {
        try_files $uri $uri/ $uri.html =404;
    }

    listen 45.61.58.125:80;
    listen 45.61.58.125:443 ssl;

    # Reused from the sibling games hub — CF proxy (Full, non-strict) does not
    # validate the origin cert's hostname, so this is accepted for 90210 too.
    ssl_certificate     /etc/letsencrypt/live/games.agentabrams.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/games.agentabrams.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
}