Add shared public edge (nginx + certbot)

One nginx owns host ports 80/443 for every project (Gitea, Musify) and
proxies by container name over infra-net and gitea_gitea; a certbot
service renews the Let's Encrypt certificates.

edge/compose.yml

@@ -0,0 +1,51 @@
+# Shared public edge: the only thing that publishes host ports 80/443. One
+# nginx terminates TLS for every project's domains (Gitea, Musify, ...) and
+# proxies to their containers by name, over the networks below. Certificates
+# come from Let's Encrypt (webroot), renewed by the certbot service.
+#
+#   docker compose -f edge/compose.yml up -d
+#
+# Requires `infra-net` (created by ../compose.yml) and `gitea_gitea` (created
+# by the Gitea stack) to already exist.
+
+name: edge
+
+networks:
+  infra-net:
+    name: infra-net
+    external: true
+  gitea:
+    name: gitea_gitea
+    external: true
+
+services:
+  nginx:
+    image: nginx:1.27-alpine
+    container_name: edge-nginx
+    # The subshell reloads nginx every 6h so renewed certificates get picked up.
+    command:
+      - /bin/sh
+      - -c
+      - "(while :; do sleep 6h; nginx -s reload; done) & exec nginx -g 'daemon off;'"
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - ./conf.d:/etc/nginx/conf.d:ro
+      - ./snippets:/etc/nginx/snippets:ro
+      - ./certbot/www:/var/www/certbot:ro
+      - ./certbot/conf:/etc/letsencrypt:ro
+    networks: [gitea, infra-net]
+    restart: unless-stopped
+
+  certbot:
+    image: certbot/certbot
+    container_name: edge-certbot
+    entrypoint:
+      - /bin/sh
+      - -c
+      - "trap exit TERM; while :; do certbot renew --webroot -w /var/www/certbot --quiet; sleep 12h & wait $${!}; done"
+    volumes:
+      - ./certbot/conf:/etc/letsencrypt
+      - ./certbot/www:/var/www/certbot
+    restart: unless-stopped

edge/conf.d/00-common.conf

@@ -0,0 +1,8 @@
+# Docker's embedded DNS. Every upstream below is a `set $upstream ...` so
+# nginx resolves it per request and starts even if a project's stack is down.
+resolver 127.0.0.11 valid=10s;
+
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    ''      close;
+}

edge/conf.d/gitea.conf

@@ -0,0 +1,24 @@
+server {
+    listen 80;
+    listen [::]:80;
+    server_name gitea.ikerdemo.cat;
+    include /etc/nginx/snippets/acme-redirect.conf;
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    http2 on;
+    server_name gitea.ikerdemo.cat;
+    client_max_body_size 512M;
+
+    ssl_certificate     /etc/letsencrypt/live/gitea.ikerdemo.cat/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/gitea.ikerdemo.cat/privkey.pem;
+    include /etc/nginx/snippets/tls.conf;
+
+    location / {
+        set $upstream http://gitea:3000;
+        proxy_pass $upstream;
+        include /etc/nginx/snippets/proxy.conf;
+    }
+}

edge/conf.d/musify.conf

@@ -0,0 +1,102 @@
+# One certificate (live/musify.ikerdemo.cat) covers the five hostnames.
+server {
+    listen 80;
+    listen [::]:80;
+    server_name musify.ikerdemo.cat musifyapi.ikerdemo.cat
+                musifystream.ikerdemo.cat auth.ikerdemo.cat s3.ikerdemo.cat;
+    include /etc/nginx/snippets/acme-redirect.conf;
+}
+
+# Web player. Uploads are posted to its own form actions.
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    http2 on;
+    server_name musify.ikerdemo.cat;
+    client_max_body_size 1024m;
+
+    ssl_certificate     /etc/letsencrypt/live/musify.ikerdemo.cat/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/musify.ikerdemo.cat/privkey.pem;
+    include /etc/nginx/snippets/tls.conf;
+
+    location / {
+        set $upstream http://web-player:3000;
+        proxy_pass $upstream;
+        include /etc/nginx/snippets/proxy.conf;
+    }
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    http2 on;
+    server_name musifyapi.ikerdemo.cat;
+
+    ssl_certificate     /etc/letsencrypt/live/musify.ikerdemo.cat/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/musify.ikerdemo.cat/privkey.pem;
+    include /etc/nginx/snippets/tls.conf;
+
+    location / {
+        set $upstream http://api:5111;
+        proxy_pass $upstream;
+        include /etc/nginx/snippets/proxy.conf;
+    }
+}
+
+# Audio bytes. Buffering off keeps range requests (seeking) responsive.
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    http2 on;
+    server_name musifystream.ikerdemo.cat;
+
+    ssl_certificate     /etc/letsencrypt/live/musify.ikerdemo.cat/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/musify.ikerdemo.cat/privkey.pem;
+    include /etc/nginx/snippets/tls.conf;
+
+    location / {
+        set $upstream http://gateway:8081;
+        proxy_pass $upstream;
+        include /etc/nginx/snippets/proxy.conf;
+        proxy_buffering off;
+    }
+}
+
+# Zitadel, shared with the other projects (hence the generic hostname).
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    http2 on;
+    server_name auth.ikerdemo.cat;
+
+    ssl_certificate     /etc/letsencrypt/live/musify.ikerdemo.cat/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/musify.ikerdemo.cat/privkey.pem;
+    include /etc/nginx/snippets/tls.conf;
+
+    location / {
+        set $upstream http://zitadel:8080;
+        proxy_pass $upstream;
+        include /etc/nginx/snippets/proxy.conf;
+        grpc_set_header Host $host;
+    }
+}
+
+# SeaweedFS S3: presigned PUT/GET straight from the browser.
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    http2 on;
+    server_name s3.ikerdemo.cat;
+    client_max_body_size 1024m;
+
+    ssl_certificate     /etc/letsencrypt/live/musify.ikerdemo.cat/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/musify.ikerdemo.cat/privkey.pem;
+    include /etc/nginx/snippets/tls.conf;
+
+    location / {
+        set $upstream http://seaweedfs:8333;
+        proxy_pass $upstream;
+        include /etc/nginx/snippets/proxy.conf;
+        proxy_request_buffering off;
+    }
+}

edge/snippets/acme-redirect.conf

@@ -0,0 +1,7 @@
+location /.well-known/acme-challenge/ {
+    root /var/www/certbot;
+}
+
+location / {
+    return 301 https://$host$request_uri;
+}

edge/snippets/proxy.conf

@@ -0,0 +1,7 @@
+proxy_http_version 1.1;
+proxy_set_header Host $host;
+proxy_set_header X-Real-IP $remote_addr;
+proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+proxy_set_header X-Forwarded-Proto $scheme;
+proxy_set_header Upgrade $http_upgrade;
+proxy_set_header Connection $connection_upgrade;

edge/snippets/tls.conf

@@ -0,0 +1,2 @@
+ssl_protocols TLSv1.2 TLSv1.3;
+ssl_ciphers HIGH:!aNULL:!MD5;