Add cabinet.agentabrams.com nginx vhost draft (gated go-live)

a8f270ea5f77e126053738b3b25248f5de505725 · 2026-07-22 21:23:47 -0700 · Steve Abrams

Files touched

A deploy/cabinet.agentabrams.com.nginx

Diff

commit a8f270ea5f77e126053738b3b25248f5de505725
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Wed Jul 22 21:23:47 2026 -0700

    Add cabinet.agentabrams.com nginx vhost draft (gated go-live)
---
 deploy/cabinet.agentabrams.com.nginx | 46 ++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)

diff --git a/deploy/cabinet.agentabrams.com.nginx b/deploy/cabinet.agentabrams.com.nginx
new file mode 100644
index 0000000..3b75fbf
--- /dev/null
+++ b/deploy/cabinet.agentabrams.com.nginx
@@ -0,0 +1,46 @@
+# cabinet.agentabrams.com — public door onto the cabinet-mindmap app (mac3 tailnet 100.82.17.107:9766)
+# Modeled on animals.agentabrams.com, BUT the app is OPEN (no built-in auth) so nginx basic-auth is MANDATORY.
+# /healthz stays UNAUTHed so the fleet keepalive doesn't misread a healthy 401 as dead.
+server {
+  listen 80;
+  server_name cabinet.agentabrams.com;
+  location ^~ /.well-known/acme-challenge/ { allow all; root /var/www/html; }
+  return 301 https://$host$request_uri;
+}
+
+server {
+  listen 45.61.58.125:443 ssl http2;
+  server_name cabinet.agentabrams.com;
+
+  ssl_certificate     /etc/letsencrypt/live/cabinet.agentabrams.com/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/cabinet.agentabrams.com/privkey.pem;
+  include /etc/letsencrypt/options-ssl-nginx.conf;
+  ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+  access_log /var/log/nginx/cabinet.agentabrams.com.access.log;
+  error_log  /var/log/nginx/cabinet.agentabrams.com.error.log;
+
+  client_max_body_size 10M;
+
+  # Open, unauthenticated health check (BEFORE the auth gate) — fleet keepalive reads this.
+  location = /healthz {
+    auth_basic off;
+    proxy_pass http://100.82.17.107:9766/healthz;
+    proxy_set_header Host $host;
+  }
+
+  # Everything else: admin/DW2024! basic-auth (the app itself has none).
+  location / {
+    auth_basic "cabinet";
+    auth_basic_user_file /etc/nginx/.htpasswd-cabinet;
+
+    proxy_pass http://100.82.17.107:9766;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_connect_timeout 10s;
+    proxy_read_timeout 60s;
+  }
+}

← 9ba0bd6 Add Officer Consulting (vp-consulting) to the cabinet · back to Agent Cabinet · cabinet.aa vhost: IP-bind :80 too (agentabrams default_serve 8058934 →