2026-06-12 14:42:14 +03:30
|
|
|
# ==========================================================================
|
|
|
|
|
# FlatRender — flatrender.ir (add inside the http{} block of mirror-nginx)
|
|
|
|
|
#
|
|
|
|
|
# Routes the three public domains to the FlatRender host ports on 171.22.25.73
|
|
|
|
|
# (FRONTEND_PORT / GATEWAY_PORT / MINIO_PORT from the deploy ENV_FILE).
|
|
|
|
|
#
|
2026-06-15 10:46:32 +03:30
|
|
|
# The mirror-nginx config file lives on the HOST at /root/mirror-server/nginx/nginx.conf
|
|
|
|
|
# (bind-mounted read-only into the container). Add these blocks there.
|
2026-06-12 14:42:14 +03:30
|
|
|
#
|
2026-06-15 10:46:32 +03:30
|
|
|
# ⚠️ CERT-MOUNT TRAP: mirror-nginx mounts cert dirs INDIVIDUALLY
|
|
|
|
|
# (/etc/ssl/{soroushasadi,meezi,...}). A new /etc/ssl/soroushasadi/flatrender/ on the host is
|
|
|
|
|
# INVISIBLE inside the container → nginx -t "cannot load certificate". So NEST the
|
|
|
|
|
# flatrender cert under an already-mounted dir:
|
|
|
|
|
# mkdir -p /etc/ssl/soroushasadi/flatrender
|
|
|
|
|
# cp <cert>/fullchain.pem <cert>/privateKey.pem /etc/ssl/soroushasadi/flatrender/
|
|
|
|
|
# The cert must cover flatrender.ir + api. + storage. (wildcard *.flatrender.ir + apex,
|
|
|
|
|
# or a SAN cert).
|
|
|
|
|
#
|
|
|
|
|
# ⚠️ After editing nginx.conf with `sed -i` (which replaces the file inode), the
|
|
|
|
|
# running container keeps the OLD inode → you must RESTART, not just reload:
|
|
|
|
|
# docker restart mirror-nginx # ~3s blip for all sites
|
|
|
|
|
# A plain edit that keeps the inode + reload is fine:
|
|
|
|
|
# docker exec mirror-nginx nginx -t && docker exec mirror-nginx nginx -s reload
|
|
|
|
|
#
|
|
|
|
|
# Test routing locally (bypasses DNS):
|
|
|
|
|
# curl -sk --resolve flatrender.ir:443:127.0.0.1 https://flatrender.ir/ | head -c 60
|
|
|
|
|
# # must show: <!DOCTYPE html><html lang="fa" dir="rtl">
|
2026-06-12 14:42:14 +03:30
|
|
|
# ==========================================================================
|
|
|
|
|
|
|
|
|
|
server {
|
|
|
|
|
listen 80;
|
2026-06-15 23:59:54 +03:30
|
|
|
server_name flatrender.ir www.flatrender.ir api.flatrender.ir storage.flatrender.ir pay.flatrender.ir;
|
2026-06-12 14:42:14 +03:30
|
|
|
return 301 https://$host$request_uri;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
# ── Site (Next.js frontend → FRONTEND_PORT) ───────────────────────────────
|
|
|
|
|
server {
|
|
|
|
|
listen 443 ssl; http2 on;
|
|
|
|
|
server_name flatrender.ir www.flatrender.ir;
|
|
|
|
|
client_max_body_size 25m;
|
2026-06-15 10:46:32 +03:30
|
|
|
ssl_certificate /etc/ssl/soroushasadi/flatrender/fullchain.pem;
|
|
|
|
|
ssl_certificate_key /etc/ssl/soroushasadi/flatrender/privateKey.pem;
|
2026-06-12 14:42:14 +03:30
|
|
|
location / {
|
|
|
|
|
proxy_pass http://171.22.25.73:1600;
|
|
|
|
|
proxy_http_version 1.1;
|
|
|
|
|
proxy_set_header Host $host;
|
|
|
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
|
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
|
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
|
|
|
proxy_set_header Connection $connection_upgrade;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
# ── API gateway (→ GATEWAY_PORT) ──────────────────────────────────────────
|
|
|
|
|
server {
|
|
|
|
|
listen 443 ssl; http2 on;
|
|
|
|
|
server_name api.flatrender.ir;
|
|
|
|
|
client_max_body_size 512m; # large uploads routed through the gateway
|
2026-06-15 10:46:32 +03:30
|
|
|
ssl_certificate /etc/ssl/soroushasadi/flatrender/fullchain.pem;
|
|
|
|
|
ssl_certificate_key /etc/ssl/soroushasadi/flatrender/privateKey.pem;
|
2026-06-12 14:42:14 +03:30
|
|
|
location / {
|
|
|
|
|
proxy_pass http://171.22.25.73:1605;
|
|
|
|
|
proxy_http_version 1.1;
|
|
|
|
|
proxy_set_header Host $host;
|
|
|
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
|
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
|
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
|
|
proxy_set_header Upgrade $http_upgrade; # render-progress WebSocket
|
|
|
|
|
proxy_set_header Connection $connection_upgrade;
|
|
|
|
|
proxy_read_timeout 3600s;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
# ── MinIO storage (→ MINIO_PORT) ──────────────────────────────────────────
|
|
|
|
|
server {
|
|
|
|
|
listen 443 ssl; http2 on;
|
|
|
|
|
server_name storage.flatrender.ir;
|
|
|
|
|
client_max_body_size 512m;
|
2026-06-15 10:46:32 +03:30
|
|
|
ssl_certificate /etc/ssl/soroushasadi/flatrender/fullchain.pem;
|
|
|
|
|
ssl_certificate_key /etc/ssl/soroushasadi/flatrender/privateKey.pem;
|
2026-06-12 14:42:14 +03:30
|
|
|
location / {
|
|
|
|
|
proxy_pass http://171.22.25.73:1610;
|
|
|
|
|
proxy_set_header Host $host;
|
|
|
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
|
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
|
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
|
|
}
|
|
|
|
|
}
|
2026-06-15 23:59:54 +03:30
|
|
|
|
|
|
|
|
# ── Payment broker (→ PAY_PORT) — pay.flatrender.ir ───────────────────────
|
|
|
|
|
# The single ZarinPal-verified callback domain. ZarinPal redirects users to
|
|
|
|
|
# pay.flatrender.ir/callback/zarinpal; the broker then bounces them to the
|
|
|
|
|
# originating site's return_url. Must NOT be cached by any upstream CDN.
|
|
|
|
|
server {
|
|
|
|
|
listen 443 ssl; http2 on;
|
|
|
|
|
server_name pay.flatrender.ir;
|
|
|
|
|
client_max_body_size 5m;
|
|
|
|
|
ssl_certificate /etc/ssl/soroushasadi/flatrender/fullchain.pem;
|
|
|
|
|
ssl_certificate_key /etc/ssl/soroushasadi/flatrender/privateKey.pem;
|
|
|
|
|
location / {
|
|
|
|
|
proxy_pass http://171.22.25.73:1607;
|
|
|
|
|
proxy_http_version 1.1;
|
|
|
|
|
proxy_set_header Host $host;
|
|
|
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
|
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
|
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
|
|
}
|
|
|
|
|
}
|
