Add the example stack payloads

The files copied to /srv/stacks/<stack>/ verbatim: compose files, vhosts, Prometheus configuration, the webapp image source. Payloads are data, never templated and never linted as Ansible content. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
2026-09-16 03:58:01 +02:00
parent 7b52e9af9e
commit b76c76e3b0
16 changed files with 399 additions and 0 deletions
@@ -0,0 +1,3 @@
+# Applies to every vhost. nginx defaults to 1M, which silently truncates ordinary
+# file uploads.
+client_max_body_size 100M;
@@ -0,0 +1,23 @@
+# Per-vhost nginx configuration for app.example.com, included by nginx-proxy.
+#
+# A container that sets VIRTUAL_HOST gets its vhost generated automatically and
+# needs nothing here. This file is for the cases generation cannot express:
+# routes to a service that is not the vhost's main container, and access rules.
+
+# Anything not otherwise routed goes to the public site.
+location = / {
+    return 301 https://app.example.com/tools/;
+}
+
+# Internal-only: the metrics stack, reachable from the private network and
+# nowhere else. Keep the deny rule directly beneath the allow rule — nginx takes
+# the first match, so an allow added below a `deny all` does nothing.
+location ^~ /internal/metrics/ {
+    allow 10.0.0.0/8;
+    deny all;
+
+    proxy_pass http://prometheus:9090/internal/metrics/;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+}