`deploy/nginx/grant.agentabrams.com.conf`

123 lines
# nginx vhost: grant.agentabrams.com
# Reverse-proxy to Next.js grant-app running on 127.0.0.1:7450.
#
# OPERATOR NOTES
# --------------
# 1. certbot will MANAGE this file once you run:
#      certbot --nginx -d grant.agentabrams.com
#    It will insert/update the ssl_certificate, ssl_certificate_key, and
#    redirect-to-https lines automatically. The ssl block below is the
#    hand-maintained reference; certbot may rewrite it — that is expected.
#
# 2. Place this file and symlink before running certbot:
#      cp deploy/nginx/grant.agentabrams.com.conf \
#           /etc/nginx/sites-available/grant.agentabrams.com
#      ln -sf /etc/nginx/sites-available/grant.agentabrams.com \
#           /etc/nginx/sites-enabled/grant.agentabrams.com
#      nginx -t && systemctl reload nginx
#
# 3. client_max_body_size covers file uploads (grant documents, org logos).
#    Raise to 50m if the app adds bulk-import features.

# ---------------------------------------------------------------------------
# HTTP → HTTPS redirect (port 80)
# certbot will add its own redirect block here; this one is pre-flight.
# ---------------------------------------------------------------------------
server {
    listen 80;
    listen [::]:80;
    server_name grant.agentabrams.com;

    # ACME challenge for Let's Encrypt renewal (certbot manages this)
    location /.well-known/acme-challenge/ {
        root /var/www/html;
    }

    # Redirect all other HTTP traffic to HTTPS
    location / {
        return 301 https://$host$request_uri;
    }
}

# ---------------------------------------------------------------------------
# HTTPS — main app (port 443)
# ---------------------------------------------------------------------------
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name grant.agentabrams.com;

    # --- TLS ---
    # Paths managed by certbot. Do not edit manually after certbot runs.
    ssl_certificate     /etc/letsencrypt/live/grant.agentabrams.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/grant.agentabrams.com/privkey.pem;

    # Modern TLS config — certbot will append/update include line below
    # include /etc/letsencrypt/options-ssl-nginx.conf;
    # ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    # --- General ---
    client_max_body_size 10m;

    # --- Security headers ---
    # Uncomment and tune after a security audit; HSTS in particular is
    # sticky (browsers cache it) so only enable when TLS is confirmed stable.
    #
    # add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
    # add_header X-Frame-Options "SAMEORIGIN" always;
    # add_header X-Content-Type-Options "nosniff" always;
    # add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    # add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
    # add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self' https:;" always;

    # --- Logging ---
    access_log /var/log/nginx/grant.agentabrams.com.access.log;
    error_log  /var/log/nginx/grant.agentabrams.com.error.log;

    # --- Proxy to Next.js ---
    location / {
        proxy_pass http://127.0.0.1:7450;

        # Standard proxy headers — Next.js reads these for request.ip,
        # req.headers.host, and canonical URL construction.
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # WebSocket / streaming support — required for Next.js HMR in dev
        # and Server-Sent Events / streaming responses in production.
        proxy_set_header Upgrade    $http_upgrade;
        proxy_set_header Connection "upgrade";

        # Timeouts — Next.js SSR + DB queries can be slow on first cold hit;
        # 60s gives headroom without leaving browsers hanging indefinitely.
        proxy_connect_timeout 10s;
        proxy_send_timeout    60s;
        proxy_read_timeout    60s;

        # Disable buffering for streaming responses (Next.js App Router uses
        # React streaming / Suspense; buffering breaks the chunked delivery).
        proxy_buffering    off;
        proxy_buffer_size  4k;
    }

    # --- Static asset caching ---
    # Next.js content-hashes _next/static filenames, so they are safe to
    # cache aggressively. Reduces round-trips for repeat visitors.
    location /_next/static/ {
        proxy_pass http://127.0.0.1:7450;
        proxy_set_header Host            $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_cache_valid 200 1y;
        add_header Cache-Control "public, max-age=31536000, immutable";
    }

    # --- Public assets ---
    location /public/ {
        proxy_pass http://127.0.0.1:7450;
        proxy_set_header Host            $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}