`deploy/cabinet.agentabrams.com.nginx`

47 lines
# cabinet.agentabrams.com — public door onto the cabinet-mindmap app (mac3 tailnet 100.82.17.107:9766)
# Modeled on animals.agentabrams.com, BUT the app is OPEN (no built-in auth) so nginx basic-auth is MANDATORY.
# /healthz stays UNAUTHed so the fleet keepalive doesn't misread a healthy 401 as dead.
server {
  listen 45.61.58.125:80;
  server_name cabinet.agentabrams.com;
  location ^~ /.well-known/acme-challenge/ { allow all; root /var/www/html; }
  return 301 https://$host$request_uri;
}

server {
  listen 45.61.58.125:443 ssl http2;
  server_name cabinet.agentabrams.com;

  ssl_certificate     /etc/letsencrypt/live/cabinet.agentabrams.com/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/cabinet.agentabrams.com/privkey.pem;
  include /etc/letsencrypt/options-ssl-nginx.conf;
  ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

  access_log /var/log/nginx/cabinet.agentabrams.com.access.log;
  error_log  /var/log/nginx/cabinet.agentabrams.com.error.log;

  client_max_body_size 10M;

  # Open, unauthenticated health check (BEFORE the auth gate) — fleet keepalive reads this.
  location = /healthz {
    auth_basic off;
    proxy_pass http://100.82.17.107:9766/healthz;
    proxy_set_header Host $host;
  }

  # Everything else: admin/DW2024! basic-auth (the app itself has none).
  location / {
    auth_basic "cabinet";
    auth_basic_user_file /etc/nginx/.htpasswd-cabinet;

    proxy_pass http://100.82.17.107:9766;
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_connect_timeout 10s;
    proxy_read_timeout 60s;
  }
}