Admin
2507d98c55
Compose file for ikerdemo.cat with nginx as TLS terminator, the three .NET services, Zitadel and the storage stack. Values come from deploy/.env.prod (untracked). Adds the frontend image, the migration script and the Zitadel provisioning for production.
121 lines
3.4 KiB
Plaintext
121 lines
3.4 KiB
Plaintext
# Cloudflare (Full strict) terminates the public edge; this box only needs to
|
|
# trust the Cloudflare Origin Certificate. Each server block proxies to a
|
|
# container by its Docker Compose service name.
|
|
#
|
|
# proxy_pass targets use a variable + the embedded Docker DNS resolver so nginx
|
|
# re-resolves the service name on every request instead of caching the first
|
|
# container IP (which goes stale whenever a service is recreated/restarted).
|
|
|
|
resolver 127.0.0.11 valid=10s;
|
|
|
|
server {
|
|
listen 80;
|
|
server_name api.ikerdemo.cat stream.ikerdemo.cat auth.ikerdemo.cat s3.ikerdemo.cat ikerdemo.cat www.ikerdemo.cat;
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl;
|
|
http2 on;
|
|
server_name api.ikerdemo.cat;
|
|
|
|
ssl_certificate /etc/nginx/certs/origin.pem;
|
|
ssl_certificate_key /etc/nginx/certs/origin.key;
|
|
|
|
location / {
|
|
set $upstream http://api:5111;
|
|
proxy_pass $upstream;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
}
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl;
|
|
http2 on;
|
|
server_name stream.ikerdemo.cat;
|
|
|
|
ssl_certificate /etc/nginx/certs/origin.pem;
|
|
ssl_certificate_key /etc/nginx/certs/origin.key;
|
|
|
|
location / {
|
|
set $upstream http://gateway:8081;
|
|
proxy_pass $upstream;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
}
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl;
|
|
http2 on;
|
|
server_name auth.ikerdemo.cat;
|
|
|
|
ssl_certificate /etc/nginx/certs/origin.pem;
|
|
ssl_certificate_key /etc/nginx/certs/origin.key;
|
|
|
|
location / {
|
|
set $upstream http://zitadel:8080;
|
|
proxy_pass $upstream;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
grpc_set_header Host $host;
|
|
}
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl;
|
|
http2 on;
|
|
server_name s3.ikerdemo.cat;
|
|
client_max_body_size 1024m;
|
|
|
|
ssl_certificate /etc/nginx/certs/origin.pem;
|
|
ssl_certificate_key /etc/nginx/certs/origin.key;
|
|
|
|
location / {
|
|
set $upstream http://seaweedfs:8333;
|
|
proxy_pass $upstream;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
proxy_request_buffering off;
|
|
}
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl;
|
|
http2 on;
|
|
server_name www.ikerdemo.cat;
|
|
|
|
ssl_certificate /etc/nginx/certs/origin.pem;
|
|
ssl_certificate_key /etc/nginx/certs/origin.key;
|
|
|
|
return 301 https://ikerdemo.cat$request_uri;
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl;
|
|
http2 on;
|
|
server_name ikerdemo.cat;
|
|
|
|
ssl_certificate /etc/nginx/certs/origin.pem;
|
|
ssl_certificate_key /etc/nginx/certs/origin.key;
|
|
|
|
location / {
|
|
set $upstream http://frontend:3000;
|
|
proxy_pass $upstream;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
}
|
|
}
|