initial

deploy/nginx.be-url-shortener.fragment

@@ -0,0 +1,29 @@
+# BE Alpine — url-shortener vhost fragment
+# Include from /etc/nginx/conf.d/apps.conf or separate file.
+#
+# Docroot: /var/www/localhost/htdocs/apps/s/public
+# PHP-FPM: same socket as crash reporter unless load warrants a pool.
+
+server {
+	listen 80;
+	server_name s.f0xx.org;
+
+	root /var/www/localhost/htdocs/apps/s/public;
+	index index.php;
+
+	# API + QR
+	location ^~ /api/ {
+		try_files $uri /index.php?$query_string;
+	}
+
+	# Short slug redirect (6–16 hex chars). Regex MUST be quoted — bare {6,16} breaks nginx -t.
+	location ~ "^/[a-f0-9]{6,16}$" {
+		try_files $uri /index.php?$query_string;
+	}
+
+	location ~ \.php$ {
+		include fastcgi_params;
+		fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+		fastcgi_pass unix:/run/php-fpm.socket;
+	}
+}

deploy/nginx.fe-s.f0xx.org.snippet

@@ -0,0 +1,48 @@
+# FE Gentoo — server block for s.f0xx.org (URL shortener)
+# File: tmp/FE_gentoo/etc/nginx/nginx.conf  OR conf.d/s.f0xx.org.conf
+#
+# TLS cert (confirmed on FE):
+#   ssl_certificate     /etc/letsencrypt/live/s.f0xx.org/fullchain.pem;
+#   ssl_certificate_key /etc/letsencrypt/live/s.f0xx.org/privkey.pem;
+
+server {
+	listen 80;
+	server_name s.f0xx.org;
+	return 301 https://$host$request_uri;
+}
+
+server {
+	listen 443 ssl http2;
+	server_name s.f0xx.org;
+
+	ssl_certificate     /etc/letsencrypt/live/s.f0xx.org/fullchain.pem;
+	ssl_certificate_key /etc/letsencrypt/live/s.f0xx.org/privkey.pem;
+
+	access_log /var/log/nginx/s.f0xx.org.access_log main;
+	error_log /var/log/nginx/s.f0xx.org.error_log info;
+
+	ssl_certificate /etc/letsencrypt/live/s.f0xx.org/fullchain.pem;
+	ssl_certificate_key /etc/letsencrypt/live/s.f0xx.org/privkey.pem;
+
+
+	# All paths → BE :80 (PHP-FPM url-shortener vhost)
+	location / {
+		proxy_pass http://artc0.intra.raptor.org:80;
+		proxy_http_version 1.1;
+		proxy_set_header Host              $host;
+		proxy_set_header X-Real-IP         $remote_addr;
+		proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto $scheme;
+		proxy_connect_timeout 120s;
+		proxy_send_timeout 120s;
+		proxy_read_timeout 180s;
+		proxy_buffers 16 16m;
+		proxy_buffer_size 16m;
+		client_body_buffer_size 16m;
+		client_max_body_size 16m;
+		proxy_buffering off;
+		proxy_set_header Upgrade $http_upgrade;
+		proxy_set_header Connection $connection_upgrade;
+		proxy_cache_bypass $http_upgrade;
+	}
+}