Lucas WintherandClaude Opus 5
b76c76e3b0
The files copied to /srv/stacks/<stack>/ verbatim: compose files, vhosts, Prometheus configuration, the webapp image source. Payloads are data, never templated and never linted as Ansible content. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
24 lines
939 B
Plaintext
24 lines
939 B
Plaintext
# Per-vhost nginx configuration for app.example.com, included by nginx-proxy.
|
|
#
|
|
# A container that sets VIRTUAL_HOST gets its vhost generated automatically and
|
|
# needs nothing here. This file is for the cases generation cannot express:
|
|
# routes to a service that is not the vhost's main container, and access rules.
|
|
|
|
# Anything not otherwise routed goes to the public site.
|
|
location = / {
|
|
return 301 https://app.example.com/tools/;
|
|
}
|
|
|
|
# Internal-only: the metrics stack, reachable from the private network and
|
|
# nowhere else. Keep the deny rule directly beneath the allow rule — nginx takes
|
|
# the first match, so an allow added below a `deny all` does nothing.
|
|
location ^~ /internal/metrics/ {
|
|
allow 10.0.0.0/8;
|
|
deny all;
|
|
|
|
proxy_pass http://prometheus:9090/internal/metrics/;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
}
|