awoooi/infra/ansible/roles/nginx/templates/188-internal-tools-https.conf.j2

# 188-internal-tools-https.conf.j2
# HTTPS entrypoints for public tool domains whose DNS lands on 188.
# Restored during the 2026-05-06 dirty-reboot incident, then captured in Ansible
# so nginx-sync cannot accidentally remove these routes.

# AWOOOI internal-tools HTTP-01 managed block
server {
    listen 80;
    server_name
        gitea.wooo.work
        sentry.wooo.work
        langfuse.wooo.work;

    location /.well-known/acme-challenge/ {
        root /var/www/html;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    listen 80;
    server_name
        harbor.wooo.work
        registry.wooo.work;

    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    listen 443 ssl http2;
    server_name signoz.wooo.work;
    ssl_certificate /etc/letsencrypt/live/sentry.wooo.work/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/sentry.wooo.work/privkey.pem;

    location / {
        proxy_pass http://192.168.0.110:8080;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_read_timeout 300s;
    }
}

server {
    listen 443 ssl http2;
    server_name stock.wooo.work;
    ssl_certificate /etc/letsencrypt/live/stock.wooo.work/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/stock.wooo.work/privkey.pem;

    location / {
        proxy_pass http://192.168.0.110:31235;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

server {
    listen 443 ssl http2;
    server_name sentry.wooo.work;
    ssl_certificate /etc/letsencrypt/live/sentry.wooo.work/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/sentry.wooo.work/privkey.pem;
    client_max_body_size 50m;

    location / {
        proxy_pass http://192.168.0.110:9000;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 300s;
    }
}

server {
    listen 443 ssl http2;
    server_name gitea.wooo.work;
    ssl_certificate /etc/letsencrypt/live/sentry.wooo.work/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/sentry.wooo.work/privkey.pem;
    client_max_body_size 512m;

    location / {
        proxy_pass http://192.168.0.110:3001;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_read_timeout 300s;
    }
}

server {
    listen 443 ssl http2;
    server_name langfuse.wooo.work;
    ssl_certificate /etc/letsencrypt/live/sentry.wooo.work/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/sentry.wooo.work/privkey.pem;

    location / {
        proxy_pass http://192.168.0.110:3100;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

server {
    listen 443 ssl http2;
    server_name harbor.wooo.work;
    ssl_certificate /etc/letsencrypt/live/harbor.wooo.work/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/harbor.wooo.work/privkey.pem;
    client_max_body_size 0;

    location / {
        proxy_pass http://192.168.0.110:5000;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 900s;
    }
}

server {
    listen 443 ssl http2;
    server_name registry.wooo.work;
    ssl_certificate /etc/letsencrypt/live/registry.wooo.work/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/registry.wooo.work/privkey.pem;
    client_max_body_size 0;

    location / {
        proxy_pass http://192.168.0.110:5000;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 900s;
    }
}