From 339029832202dd39c685b596f530a7e7838bb766 Mon Sep 17 00:00:00 2001
From: Anton Afanasyeu <a.afanasieff@gmail.com>
Date: Sat, 30 May 2026 20:59:38 +0200
Subject: [PATCH] snapshot

---
 examples/app_hub/DEPLOY.md                    | 17 +++++++++---
 .../backend/nginx.fe-apps.conf.fragment       | 21 +++++++++++++++
 .../backend/scripts/apply-build-nginx-fix.sh  | 27 +++++++++++++++++++
 3 files changed, 61 insertions(+), 4 deletions(-)
 create mode 100644 examples/crash_reporter/backend/nginx.fe-apps.conf.fragment
 create mode 100755 examples/crash_reporter/backend/scripts/apply-build-nginx-fix.sh

diff --git a/examples/app_hub/DEPLOY.md b/examples/app_hub/DEPLOY.md
index fcbef9f..83b3a22 100644
--- a/examples/app_hub/DEPLOY.md
+++ b/examples/app_hub/DEPLOY.md
@@ -48,11 +48,20 @@ Or run (from repo, with write access to the mount):
 sudo ./examples/crash_reporter/backend/scripts/apply-be-port80-nginx.sh
 ```
 
-**FE** (`tmp/FE_gentoo/etc/nginx/nginx.conf`): hub and crashes must use
-`proxy_pass http://artc0.intra.raptor.org:80;` **without** a trailing slash or path suffix.
-See **`nginx.fe-apps.f0xx.org.snippet`**.
+**FE** (`tmp/FE_gentoo/etc/nginx/apps.conf`): build must proxy to BE **:443** like hub/crashes:
 
-The **`listen 443 ssl`** block can stay for direct HTTPS to the VM if you use it internally; public traffic from FE should prefer **:80** for one consistent vhost.
+```nginx
+proxy_pass https://artc0.intra.raptor.org/app/androidcast_project/build/;
+```
+
+Do **not** use `http://artc0.intra.raptor.org:80` for build until BE `listen 80` includes the build block.
+Copy from **`nginx.fe-apps.conf.fragment`** or run:
+
+```bash
+sudo ./examples/crash_reporter/backend/scripts/apply-build-nginx-fix.sh
+```
+
+**BE** `conf.d/apps_builder.frag` must use **full paths** (no `...` placeholders). Same script installs the repo fragment.
 
 Use prefix location for the hub (not `alias` to a single file):
 
diff --git a/examples/crash_reporter/backend/nginx.fe-apps.conf.fragment b/examples/crash_reporter/backend/nginx.fe-apps.conf.fragment
new file mode 100644
index 0000000..92296f4
--- /dev/null
+++ b/examples/crash_reporter/backend/nginx.fe-apps.conf.fragment
@@ -0,0 +1,21 @@
+# FE apps.f0xx.org — include from nginx.conf server block.
+# Build must use the same upstream style as hub/crashes (BE :443), not :80.
+
+		# Redirect without trailing slash
+		location = /app/androidcast_project/build {
+		    return 301 $scheme://$host/app/androidcast_project/build/;
+		}
+		location /app/androidcast_project/build/ {
+		    proxy_pass https://artc0.intra.raptor.org/app/androidcast_project/build/;
+		    proxy_http_version 1.1;
+		    proxy_set_header Host              $host;
+		    proxy_set_header X-Real-IP         $remote_addr;
+		    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+		    proxy_set_header X-Forwarded-Proto $scheme;
+		    proxy_set_header X-Forwarded-Host  $host;
+		    proxy_set_header Upgrade    $http_upgrade;
+		    proxy_set_header Connection $connection_upgrade;
+		    proxy_read_timeout  1800s;
+		    proxy_send_timeout  1800s;
+		    client_max_body_size 512m;
+		}
diff --git a/examples/crash_reporter/backend/scripts/apply-build-nginx-fix.sh b/examples/crash_reporter/backend/scripts/apply-build-nginx-fix.sh
new file mode 100755
index 0000000..f42aaeb
--- /dev/null
+++ b/examples/crash_reporter/backend/scripts/apply-build-nginx-fix.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# Fix builder nginx on sshfs mounts + optional reload on hosts.
+set -euo pipefail
+REPO="$(cd "$(dirname "$0")/../../.." && pwd)"
+BE_NGINX="${BE_NGINX:-$REPO/../../../tmp/BE_alpine/etc/nginx/conf.d}"
+FE_NGINX="${FE_NGINX:-$REPO/../../../tmp/FE_gentoo/etc/nginx}"
+
+install -D -m 0644 "$REPO/crash_reporter/backend/nginx.apps-builder.frag" \
+  "$BE_NGINX/apps_builder.frag"
+install -D -m 0644 "$REPO/crash_reporter/backend/nginx.fe-apps.conf.fragment" \
+  "$FE_NGINX/apps.conf"
+
+if [[ "${1:-}" == "--port80" ]]; then
+  "$REPO/crash_reporter/backend/scripts/apply-be-port80-nginx.sh" \
+    "$BE_NGINX/apps.conf"
+fi
+
+echo "Installed:"
+echo "  $BE_NGINX/apps_builder.frag"
+echo "  $FE_NGINX/apps.conf"
+echo
+echo "Reload on hosts:"
+echo "  ssh alpine-be 'sudo nginx -t && sudo rc-service nginx reload'"
+echo "  # Gentoo FE: sudo nginx -t && sudo rc-service nginx reload"
+echo
+echo "Verify:"
+echo "  curl -sSI 'https://apps.f0xx.org/app/androidcast_project/build/' | grep -E 'HTTP|location|x-powered-by'"