← back to Kamatera Nginx

sites-available/dw.greendomainbrokers.com

342 lines

# DW.greendomainbrokers.com - Designer Wallcoverings Central Portal
# All DW-Agents, admin tools, and services accessible from one place
# Cloudflare real IP detection is handled globally in /etc/nginx/conf.d/cloudflare-real-ip.conf
# Note: Run certbot after DNS is configured: sudo certbot --nginx -d dw.greendomainbrokers.com

# HTTP server (will be upgraded to HTTPS by certbot)
server {
    server_name dw.greendomainbrokers.com tools.greendomainbrokers.com;

    # Security headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;

    # Basic auth for all protected routes
    auth_basic "DW Admin Portal";
    auth_basic_user_file /etc/nginx/.htpasswd;

    # Proxy settings
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection 'upgrade';
    proxy_connect_timeout 60s;
    proxy_send_timeout 60s;
    proxy_read_timeout 60s;

    # ============================================
    # LANDING PAGE (Root) - DW Central Portal (port 7400)
    # App has its own authentication, so disable basic auth here
    # ============================================
    location / {
        auth_basic off;
        proxy_pass http://127.0.0.1:7240;
    }

    # Next.js static assets for DW Central
    location /_next/ {
        auth_basic off;
        proxy_pass http://127.0.0.1:7240;
    }

    # API routes for DW Central auth
    location /api/auth/ {
        auth_basic off;
        proxy_pass http://127.0.0.1:7240;
    }

    # Login page for DW Central
    location /login {
        auth_basic off;
        proxy_pass http://127.0.0.1:7240;
    }

    # ============================================
    # APPS - LETSBEGIN PRD & Ralphy Boy Automation (port 7300)
    # ============================================
    location /apps/letsbegin {
        auth_basic off;
        proxy_pass http://127.0.0.1:7300;
    }

    # ============================================
    # CORE SYSTEMS
    # ============================================

    location /hub/ {
        proxy_pass http://127.0.0.1:9893/;
    }

    location /dashboard/ {
        proxy_pass http://127.0.0.1:9990/;
    }

    location /import/ {
        auth_basic off;  # Uses DW Central SSO
        proxy_pass http://127.0.0.1:3002/;
    }

    location /vendor/ {
        proxy_pass http://127.0.0.1:9832/;
    }

    # ============================================
    # EXECUTIVE DASHBOARDS
    # ============================================

    location /exec/ceo/ {
        proxy_pass http://127.0.0.1:7120/;
    }

    location /exec/cfo/ {
        proxy_pass http://127.0.0.1:7121/;
    }

    location /exec/coo/ {
        proxy_pass http://127.0.0.1:7122/;
    }

    location /exec/vp-ops/ {
        proxy_pass http://127.0.0.1:7125/;
    }

    # ============================================
    # BUSINESS AGENTS
    # ============================================

    location /agent/security/ {
        proxy_pass http://127.0.0.1:9892/;
    }

    location /agent/sku/ {
        proxy_pass http://127.0.0.1:9877/;
    }

    location /agent/skills/ {
        proxy_pass http://127.0.0.1:9894/;
    }

    location /agent/bigquery/ {
        proxy_pass http://127.0.0.1:7677/;
    }

    location /agent/crash-resolver/ {
        proxy_pass http://127.0.0.1:9895/;
    }

    location /agent/uptime/ {
        proxy_pass http://127.0.0.1:9882/;
    }

    location /agent/purchasing/ {
        proxy_pass http://127.0.0.1:9880/;
    }

    location /agent/marketing/ {
        proxy_pass http://127.0.0.1:9881/;
    }

    location /agent/accounting/ {
        proxy_pass http://127.0.0.1:9885/;
    }

    location /agent/legal/ {
        proxy_pass http://127.0.0.1:9878/;
    }

    location /agent/zendesk/ {
        proxy_pass http://127.0.0.1:9884/;
    }

    location /agent/trends/ {
        proxy_pass http://127.0.0.1:9883/;
    }

    location /agent/samples/ {
        proxy_pass http://127.0.0.1:9879/;
    }

    location /agent/shopify/ {
        proxy_pass http://127.0.0.1:7238/;
    }

    # ============================================
    # MONITORING & LOGS
    # ============================================

    location /logs/ {
        proxy_pass http://127.0.0.1:7239/;
    }

    location /ui-manager/ {
        proxy_pass http://127.0.0.1:7240/;
    }

    location /attention/ {
        proxy_pass http://127.0.0.1:9886/;
    }

    # ============================================
    # BOARDROOM SERVICES
    # ============================================

    # Boardroom Agent V1 — port 9815 (has own auth)
    location /boardroom/ {
        auth_basic off;
        proxy_pass http://127.0.0.1:9815/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
    }

    # Governance Engine Frontend — port 4030 (has own auth)
    location /governance/ {
        auth_basic off;
        proxy_pass http://127.0.0.1:4030/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
    }

    # Governance API direct — port 4020 (has own auth)
    location /governance-api/ {
        auth_basic off;
        proxy_pass http://127.0.0.1:4020/;
    }

    # Governance WebSocket — port 4020
    location /governance/ws {
        auth_basic off;
        proxy_pass http://127.0.0.1:4020/ws;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 86400;
    }

    # Boardroom V2 Frontend (Lincoln) — port 4050 (has own auth)
    location /brv2/ {
        auth_basic off;
        proxy_pass http://127.0.0.1:4050/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
    }

    # V2 API direct — port 4040 (has own auth)
    location /brv2-api/ {
        auth_basic off;
        proxy_pass http://127.0.0.1:4040/;
    }

    # V2 WebSocket — port 4040
    location /brv2/ws {
        auth_basic off;
        proxy_pass http://127.0.0.1:4040/ws;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 86400;
    }

    # 3D War Room — port 7680/7681 (has own auth)
    location /warroom/ {
        auth_basic off;
        proxy_pass http://127.0.0.1:7680/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
    }

    location /warroom/ws {
        auth_basic off;
        proxy_pass http://127.0.0.1:7680/ws;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 86400;
    }

    # ============================================
    # TOOLS & UTILITIES
    # ============================================

    # Legacy /ralph/ path redirects to Letsbegin subdomain
    location /ralph/ {
        return 301 https://letsbegin.greendomainbrokers.com/;
    }

    location /portfolio/ {
        proxy_pass http://127.0.0.1:7899/;
    }

    location /room-setting {
        auth_basic off;  # Uses DW Central SSO
        proxy_pass http://127.0.0.1:3075;
    }

    location /150dpi/ {
        proxy_pass http://127.0.0.1:3150/;
    }

    location /system/ {
        proxy_pass http://127.0.0.1:8888/;
    }

    # ============================================
    # ART PRINT SHOP API (port 9875) — called from Shopify storefront
    # No auth — public API for Shopify page integration
    # ============================================
    location /art-api/ {
        auth_basic off;
        proxy_pass http://127.0.0.1:9875/api/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # CORS for Shopify cross-origin requests
        add_header Access-Control-Allow-Origin '*' always;
        add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS' always;
        add_header Access-Control-Allow-Headers 'Content-Type' always;

        if ($request_method = 'OPTIONS') {
            return 204;
        }
    }

    # ============================================
    # HEALTH CHECK (No Auth)
    # ============================================
    location /health {
        auth_basic off;
        return 200 'DW Central OK';
        add_header Content-Type text/plain;
    }

    listen [::]:443 ssl; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/dw.greendomainbrokers.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/dw.greendomainbrokers.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

server {
    if ($host = dw.greendomainbrokers.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    listen 80;
    listen [::]:80;
    server_name dw.greendomainbrokers.com tools.greendomainbrokers.com;
    return 404; # managed by Certbot


}