← back to Kamatera Nginx
sites-available/dw.greendomainbrokers.com
342 lines
# DW.greendomainbrokers.com - Designer Wallcoverings Central Portal
# All DW-Agents, admin tools, and services accessible from one place
# Cloudflare real IP detection is handled globally in /etc/nginx/conf.d/cloudflare-real-ip.conf
# Note: Run certbot after DNS is configured: sudo certbot --nginx -d dw.greendomainbrokers.com
# HTTP server (will be upgraded to HTTPS by certbot)
server {
server_name dw.greendomainbrokers.com tools.greendomainbrokers.com;
# Security headers
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
# Basic auth for all protected routes
auth_basic "DW Admin Portal";
auth_basic_user_file /etc/nginx/.htpasswd;
# Proxy settings
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_connect_timeout 60s;
proxy_send_timeout 60s;
proxy_read_timeout 60s;
# ============================================
# LANDING PAGE (Root) - DW Central Portal (port 7400)
# App has its own authentication, so disable basic auth here
# ============================================
location / {
auth_basic off;
proxy_pass http://127.0.0.1:7240;
}
# Next.js static assets for DW Central
location /_next/ {
auth_basic off;
proxy_pass http://127.0.0.1:7240;
}
# API routes for DW Central auth
location /api/auth/ {
auth_basic off;
proxy_pass http://127.0.0.1:7240;
}
# Login page for DW Central
location /login {
auth_basic off;
proxy_pass http://127.0.0.1:7240;
}
# ============================================
# APPS - LETSBEGIN PRD & Ralphy Boy Automation (port 7300)
# ============================================
location /apps/letsbegin {
auth_basic off;
proxy_pass http://127.0.0.1:7300;
}
# ============================================
# CORE SYSTEMS
# ============================================
location /hub/ {
proxy_pass http://127.0.0.1:9893/;
}
location /dashboard/ {
proxy_pass http://127.0.0.1:9990/;
}
location /import/ {
auth_basic off; # Uses DW Central SSO
proxy_pass http://127.0.0.1:3002/;
}
location /vendor/ {
proxy_pass http://127.0.0.1:9832/;
}
# ============================================
# EXECUTIVE DASHBOARDS
# ============================================
location /exec/ceo/ {
proxy_pass http://127.0.0.1:7120/;
}
location /exec/cfo/ {
proxy_pass http://127.0.0.1:7121/;
}
location /exec/coo/ {
proxy_pass http://127.0.0.1:7122/;
}
location /exec/vp-ops/ {
proxy_pass http://127.0.0.1:7125/;
}
# ============================================
# BUSINESS AGENTS
# ============================================
location /agent/security/ {
proxy_pass http://127.0.0.1:9892/;
}
location /agent/sku/ {
proxy_pass http://127.0.0.1:9877/;
}
location /agent/skills/ {
proxy_pass http://127.0.0.1:9894/;
}
location /agent/bigquery/ {
proxy_pass http://127.0.0.1:7677/;
}
location /agent/crash-resolver/ {
proxy_pass http://127.0.0.1:9895/;
}
location /agent/uptime/ {
proxy_pass http://127.0.0.1:9882/;
}
location /agent/purchasing/ {
proxy_pass http://127.0.0.1:9880/;
}
location /agent/marketing/ {
proxy_pass http://127.0.0.1:9881/;
}
location /agent/accounting/ {
proxy_pass http://127.0.0.1:9885/;
}
location /agent/legal/ {
proxy_pass http://127.0.0.1:9878/;
}
location /agent/zendesk/ {
proxy_pass http://127.0.0.1:9884/;
}
location /agent/trends/ {
proxy_pass http://127.0.0.1:9883/;
}
location /agent/samples/ {
proxy_pass http://127.0.0.1:9879/;
}
location /agent/shopify/ {
proxy_pass http://127.0.0.1:7238/;
}
# ============================================
# MONITORING & LOGS
# ============================================
location /logs/ {
proxy_pass http://127.0.0.1:7239/;
}
location /ui-manager/ {
proxy_pass http://127.0.0.1:7240/;
}
location /attention/ {
proxy_pass http://127.0.0.1:9886/;
}
# ============================================
# BOARDROOM SERVICES
# ============================================
# Boardroom Agent V1 — port 9815 (has own auth)
location /boardroom/ {
auth_basic off;
proxy_pass http://127.0.0.1:9815/;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
}
# Governance Engine Frontend — port 4030 (has own auth)
location /governance/ {
auth_basic off;
proxy_pass http://127.0.0.1:4030/;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
}
# Governance API direct — port 4020 (has own auth)
location /governance-api/ {
auth_basic off;
proxy_pass http://127.0.0.1:4020/;
}
# Governance WebSocket — port 4020
location /governance/ws {
auth_basic off;
proxy_pass http://127.0.0.1:4020/ws;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_read_timeout 86400;
}
# Boardroom V2 Frontend (Lincoln) — port 4050 (has own auth)
location /brv2/ {
auth_basic off;
proxy_pass http://127.0.0.1:4050/;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
}
# V2 API direct — port 4040 (has own auth)
location /brv2-api/ {
auth_basic off;
proxy_pass http://127.0.0.1:4040/;
}
# V2 WebSocket — port 4040
location /brv2/ws {
auth_basic off;
proxy_pass http://127.0.0.1:4040/ws;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_read_timeout 86400;
}
# 3D War Room — port 7680/7681 (has own auth)
location /warroom/ {
auth_basic off;
proxy_pass http://127.0.0.1:7680/;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
}
location /warroom/ws {
auth_basic off;
proxy_pass http://127.0.0.1:7680/ws;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_read_timeout 86400;
}
# ============================================
# TOOLS & UTILITIES
# ============================================
# Legacy /ralph/ path redirects to Letsbegin subdomain
location /ralph/ {
return 301 https://letsbegin.greendomainbrokers.com/;
}
location /portfolio/ {
proxy_pass http://127.0.0.1:7899/;
}
location /room-setting {
auth_basic off; # Uses DW Central SSO
proxy_pass http://127.0.0.1:3075;
}
location /150dpi/ {
proxy_pass http://127.0.0.1:3150/;
}
location /system/ {
proxy_pass http://127.0.0.1:8888/;
}
# ============================================
# ART PRINT SHOP API (port 9875) — called from Shopify storefront
# No auth — public API for Shopify page integration
# ============================================
location /art-api/ {
auth_basic off;
proxy_pass http://127.0.0.1:9875/api/;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
# CORS for Shopify cross-origin requests
add_header Access-Control-Allow-Origin '*' always;
add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS' always;
add_header Access-Control-Allow-Headers 'Content-Type' always;
if ($request_method = 'OPTIONS') {
return 204;
}
}
# ============================================
# HEALTH CHECK (No Auth)
# ============================================
location /health {
auth_basic off;
return 200 'DW Central OK';
add_header Content-Type text/plain;
}
listen [::]:443 ssl; # managed by Certbot
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/dw.greendomainbrokers.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/dw.greendomainbrokers.com/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
server {
if ($host = dw.greendomainbrokers.com) {
return 301 https://$host$request_uri;
} # managed by Certbot
listen 80;
listen [::]:80;
server_name dw.greendomainbrokers.com tools.greendomainbrokers.com;
return 404; # managed by Certbot
}