feat(deploy): add production stack for the VPS

Compose file for ikerdemo.cat with nginx as TLS terminator, the three .NET services, Zitadel and the storage stack. Values come from deploy/.env.prod (untracked). Adds the frontend image, the migration script and the Zitadel provisioning for production.
2026-07-20 07:27:51 +02:00
parent e09866716d
commit c3b32ad40c
5 changed files with 591 additions and 0 deletions
@@ -0,0 +1,120 @@
+# Cloudflare (Full strict) terminates the public edge; this box only needs to
+# trust the Cloudflare Origin Certificate. Each server block proxies to a
+# container by its Docker Compose service name.
+#
+# proxy_pass targets use a variable + the embedded Docker DNS resolver so nginx
+# re-resolves the service name on every request instead of caching the first
+# container IP (which goes stale whenever a service is recreated/restarted).
+
+resolver 127.0.0.11 valid=10s;
+
+server {
+    listen 80;
+    server_name api.ikerdemo.cat stream.ikerdemo.cat auth.ikerdemo.cat s3.ikerdemo.cat ikerdemo.cat www.ikerdemo.cat;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl;
+    http2 on;
+    server_name api.ikerdemo.cat;
+
+    ssl_certificate     /etc/nginx/certs/origin.pem;
+    ssl_certificate_key /etc/nginx/certs/origin.key;
+
+    location / {
+        set $upstream http://api:5111;
+        proxy_pass $upstream;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+    }
+}
+
+server {
+    listen 443 ssl;
+    http2 on;
+    server_name stream.ikerdemo.cat;
+
+    ssl_certificate     /etc/nginx/certs/origin.pem;
+    ssl_certificate_key /etc/nginx/certs/origin.key;
+
+    location / {
+        set $upstream http://gateway:8081;
+        proxy_pass $upstream;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+    }
+}
+
+server {
+    listen 443 ssl;
+    http2 on;
+    server_name auth.ikerdemo.cat;
+
+    ssl_certificate     /etc/nginx/certs/origin.pem;
+    ssl_certificate_key /etc/nginx/certs/origin.key;
+
+    location / {
+        set $upstream http://zitadel:8080;
+        proxy_pass $upstream;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_set_header X-Forwarded-Host $host;
+        grpc_set_header Host $host;
+    }
+}
+
+server {
+    listen 443 ssl;
+    http2 on;
+    server_name s3.ikerdemo.cat;
+    client_max_body_size 1024m;
+
+    ssl_certificate     /etc/nginx/certs/origin.pem;
+    ssl_certificate_key /etc/nginx/certs/origin.key;
+
+    location / {
+        set $upstream http://seaweedfs:8333;
+        proxy_pass $upstream;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_request_buffering off;
+    }
+}
+
+server {
+    listen 443 ssl;
+    http2 on;
+    server_name www.ikerdemo.cat;
+
+    ssl_certificate     /etc/nginx/certs/origin.pem;
+    ssl_certificate_key /etc/nginx/certs/origin.key;
+
+    return 301 https://ikerdemo.cat$request_uri;
+}
+
+server {
+    listen 443 ssl;
+    http2 on;
+    server_name ikerdemo.cat;
+
+    ssl_certificate     /etc/nginx/certs/origin.pem;
+    ssl_certificate_key /etc/nginx/certs/origin.key;
+
+    location / {
+        set $upstream http://frontend:3000;
+        proxy_pass $upstream;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+    }
+}