warmbly/deploy/nginx/warmbly.conf

# nginx site for a Docker-free Warmbly install: the two static frontends plus
# reverse proxies for the API, the websocket, and the tracking service.
# Replace example.com. Every server block reads one certificate covering all
# five names from /etc/letsencrypt/live/app.example.com/, so issue it first
# (certbot certonly --standalone ... --cert-name app.example.com) or nginx
# refuses the site. The proxied services bind localhost, so nothing but nginx
# is reachable.

map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

# Dashboard (web/dist)
server {
    listen 443 ssl http2;
    server_name app.example.com;
    ssl_certificate     /etc/letsencrypt/live/app.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/app.example.com/privkey.pem;

    root /opt/warmbly/web;
    index index.html;
    location / { try_files $uri $uri/ /index.html; }
    # Never cache the shell or the runtime config; hashed assets are immutable.
    location = /index.html { add_header Cache-Control "no-store"; }
    location = /config.js  { add_header Cache-Control "no-store"; }
    location /assets/ { add_header Cache-Control "public, max-age=31536000, immutable"; }
}

# Admin panel (admin/dist)
server {
    listen 443 ssl http2;
    server_name admin.example.com;
    ssl_certificate     /etc/letsencrypt/live/app.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/app.example.com/privkey.pem;

    root /opt/warmbly/admin;
    index index.html;
    location / { try_files $uri $uri/ /index.html; }
    location = /index.html { add_header Cache-Control "no-store"; }
    location = /config.js  { add_header Cache-Control "no-store"; }
    location /assets/ { add_header Cache-Control "public, max-age=31536000, immutable"; }
}

# Backend API (:8080). Set TRUSTED_PROXIES=127.0.0.1/32 in warmbly.env so the
# backend believes X-Forwarded-For from this proxy.
server {
    listen 443 ssl http2;
    server_name api.example.com;
    ssl_certificate     /etc/letsencrypt/live/app.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/app.example.com/privkey.pem;

    client_max_body_size 50m;
    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 300s;
    }
}

# Realtime websocket (:4000). WEBSOCKET_URL=wss://ws.example.com/socket/websocket
server {
    listen 443 ssl http2;
    server_name ws.example.com;
    ssl_certificate     /etc/letsencrypt/live/app.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/app.example.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:4000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 3600s;
    }
}

# Tracking (:3000). TRACKING_DOMAIN=t.example.com and
# TRACKING_TRUSTED_PROXIES=127.0.0.1/32 in warmbly.env.
server {
    listen 443 ssl http2;
    server_name t.example.com;
    ssl_certificate     /etc/letsencrypt/live/app.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/app.example.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

server {
    listen 80;
    server_name app.example.com admin.example.com api.example.com ws.example.com t.example.com;
    return 301 https://$host$request_uri;
}