Prepare isolated VPS UAT deployment bundle

2026-08-20 19:22:03 +03:00
parent bd053b073c
commit 52922b8e7f
14 changed files with 379 additions and 17 deletions
@@ -0,0 +1,45 @@
+# Do not enable this file until DNS, origin certificates, and private upstream
+# checks are complete. Adapt certificate/include paths to the VPS conventions.
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name laikapstak.li auth.laikapstak.li;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+    server_name auth.laikapstak.li;
+
+    ssl_certificate /etc/nginx/tls/laikapstak.li/origin.pem;
+    ssl_certificate_key /etc/nginx/tls/laikapstak.li/origin.key;
+
+    location / {
+        include /etc/nginx/snippets/weathertool-proxy.conf;
+        proxy_pass http://127.0.0.1:9091;
+    }
+}
+
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+    server_name laikapstak.li;
+
+    ssl_certificate /etc/nginx/tls/laikapstak.li/origin.pem;
+    ssl_certificate_key /etc/nginx/tls/laikapstak.li/origin.key;
+
+    # Start short during UAT. Increase only after TLS behavior is proven.
+    add_header Strict-Transport-Security "max-age=3600" always;
+    add_header X-Content-Type-Options nosniff always;
+    add_header Referrer-Policy no-referrer always;
+
+    include /etc/nginx/snippets/weathertool-authelia-location.conf;
+
+    location / {
+        include /etc/nginx/snippets/weathertool-proxy.conf;
+        include /etc/nginx/snippets/weathertool-authelia-authrequest.conf;
+        proxy_pass http://127.0.0.1:8002;
+    }
+}