`deploy/nginx/marketing.designerwallcoverings.com.conf`

55 lines
# DW Marketing — canonical home (DTD verdict A, 2026-07-15).
# marketing.designerwallcoverings.com now serves the Marketing Command Center
# (:9662). The reels app keeps running as its own pm2 process on :9848; the
# MCC's reels module proxies /api/reels/ui/* to it, and the raw reel MP4s are
# served publicly (no auth) via the /reels/ location below so Meta/TikTok can
# fetch the media for publishing.
#
# STAGED — not yet applied. See deploy/CUTOVER.md for the gated apply steps.
# The TLS cert for this host already exists (the reels app served HTTPS here),
# so the cutover is a proxy_pass swap, not a new cert.

server {
    listen 80;
    listen [::]:80;
    server_name marketing.designerwallcoverings.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name marketing.designerwallcoverings.com;

    ssl_certificate     /etc/letsencrypt/live/marketing.designerwallcoverings.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/marketing.designerwallcoverings.com/privkey.pem;

    client_max_body_size 32m;

    # PUBLIC passthroughs — served by the reels app (:9848) with NO auth so
    # external services can fetch them:
    #   /reels/*.mp4  → Meta/TikTok pull the reel video for content publishing
    #   /privacy /terms → Meta app-review fetches the legal pages
    # (These live in the reels app, not the MCC, so they must proxy to :9848.)
    location ~ ^/reels/[^/]+\.mp4$ {
        proxy_pass http://127.0.0.1:9848;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
    location = /privacy { proxy_pass http://127.0.0.1:9848; proxy_set_header Host $host; }
    location = /terms   { proxy_pass http://127.0.0.1:9848; proxy_set_header Host $host; }

    # Everything else → the Marketing Command Center (it enforces its own Basic auth).
    location / {
        proxy_pass http://127.0.0.1:9662;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 120s;
    }
}