Add shared public edge (nginx + certbot)

One nginx owns host ports 80/443 for every project (Gitea, Musify) and proxies by container name over infra-net and gitea_gitea; a certbot service renews the Let's Encrypt certificates.
2026-09-23 16:56:28 +02:00
parent deefb6d0cd
commit 24f801cf2f
10 changed files with 234 additions and 1 deletions
@@ -0,0 +1,102 @@
+# One certificate (live/musify.ikerdemo.cat) covers the five hostnames.
+server {
+    listen 80;
+    listen [::]:80;
+    server_name musify.ikerdemo.cat musifyapi.ikerdemo.cat
+                musifystream.ikerdemo.cat auth.ikerdemo.cat s3.ikerdemo.cat;
+    include /etc/nginx/snippets/acme-redirect.conf;
+}
+
+# Web player. Uploads are posted to its own form actions.
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    http2 on;
+    server_name musify.ikerdemo.cat;
+    client_max_body_size 1024m;
+
+    ssl_certificate     /etc/letsencrypt/live/musify.ikerdemo.cat/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/musify.ikerdemo.cat/privkey.pem;
+    include /etc/nginx/snippets/tls.conf;
+
+    location / {
+        set $upstream http://web-player:3000;
+        proxy_pass $upstream;
+        include /etc/nginx/snippets/proxy.conf;
+    }
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    http2 on;
+    server_name musifyapi.ikerdemo.cat;
+
+    ssl_certificate     /etc/letsencrypt/live/musify.ikerdemo.cat/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/musify.ikerdemo.cat/privkey.pem;
+    include /etc/nginx/snippets/tls.conf;
+
+    location / {
+        set $upstream http://api:5111;
+        proxy_pass $upstream;
+        include /etc/nginx/snippets/proxy.conf;
+    }
+}
+
+# Audio bytes. Buffering off keeps range requests (seeking) responsive.
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    http2 on;
+    server_name musifystream.ikerdemo.cat;
+
+    ssl_certificate     /etc/letsencrypt/live/musify.ikerdemo.cat/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/musify.ikerdemo.cat/privkey.pem;
+    include /etc/nginx/snippets/tls.conf;
+
+    location / {
+        set $upstream http://gateway:8081;
+        proxy_pass $upstream;
+        include /etc/nginx/snippets/proxy.conf;
+        proxy_buffering off;
+    }
+}
+
+# Zitadel, shared with the other projects (hence the generic hostname).
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    http2 on;
+    server_name auth.ikerdemo.cat;
+
+    ssl_certificate     /etc/letsencrypt/live/musify.ikerdemo.cat/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/musify.ikerdemo.cat/privkey.pem;
+    include /etc/nginx/snippets/tls.conf;
+
+    location / {
+        set $upstream http://zitadel:8080;
+        proxy_pass $upstream;
+        include /etc/nginx/snippets/proxy.conf;
+        grpc_set_header Host $host;
+    }
+}
+
+# SeaweedFS S3: presigned PUT/GET straight from the browser.
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    http2 on;
+    server_name s3.ikerdemo.cat;
+    client_max_body_size 1024m;
+
+    ssl_certificate     /etc/letsencrypt/live/musify.ikerdemo.cat/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/musify.ikerdemo.cat/privkey.pem;
+    include /etc/nginx/snippets/tls.conf;
+
+    location / {
+        set $upstream http://seaweedfs:8333;
+        proxy_pass $upstream;
+        include /etc/nginx/snippets/proxy.conf;
+        proxy_request_buffering off;
+    }
+}