admin
c2e6282efa
Replaces the earlier auto-fallback-on-upstream-error approach with an explicit flag-file toggle controlled by the deploy script. The flag is touched before stopping the app and removed on successful finish (or via trap if the deploy aborts), so a failed deploy doesn't strand the site in maintenance. - nginx/goodwalk.co.nz.svelte.conf.example: error_page 503 routes to /maintenance.html (internal); /m/ serves static maintenance assets; the / and /api/submit blocks return 503 when /etc/nginx/conf.d/ maintenance.flag exists. - nginx/maintenance.html: brand-styled "Be right back" page — full Goodwalk green background, white card with yellow accent, real Goodwalk logo, contact details fallback, auto-reload after 60s. - nginx/logo.png: maintenance-time logo (served from /m/logo.png). - nginx/nginx.conf: reverted the earlier auto-fallback edits; this file is not deployed (the prod conf is goodwalk.co.nz.svelte.conf .example). - scripts/deploy-remote.sh: copies maintenance.html + logo into the nginx container, reloads nginx so the new conf is live, touches the flag, then runs the rebuild, then clears the flag. Adds a trap-based clear_maintenance_flag fallback. Also adds a defensive env-file merger that appends new keys from deploy.env.template without clobbering live values, with a timestamped .env backup. Plus a small a11y polish unrelated to maintenance: - ServicesSection: "Learn more" links now include screen-reader-only "about <Service>" context. - base.css: adds .visually-hidden utility class. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
52 lines
1.6 KiB
Nginx Configuration File
52 lines
1.6 KiB
Nginx Configuration File
# Redirect all HTTP to HTTPS, except ACME challenges (certbot renewal)
|
|
server {
|
|
listen 80;
|
|
server_name goodwalk.co.nz www.goodwalk.co.nz;
|
|
|
|
location /.well-known/acme-challenge/ {
|
|
root /var/www/certbot;
|
|
}
|
|
|
|
location / {
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl;
|
|
server_name goodwalk.co.nz www.goodwalk.co.nz;
|
|
|
|
ssl_certificate /etc/letsencrypt/live/goodwalk.co.nz/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/goodwalk.co.nz/privkey.pem;
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_ciphers HIGH:!aNULL:!MD5;
|
|
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
add_header X-Frame-Options SAMEORIGIN always;
|
|
add_header X-Content-Type-Options nosniff always;
|
|
add_header Referrer-Policy strict-origin-when-cross-origin always;
|
|
|
|
gzip on;
|
|
gzip_types text/plain text/css application/javascript application/json image/svg+xml;
|
|
|
|
location /api/submit {
|
|
proxy_pass http://mail-api:8000/submit;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
|
|
location / {
|
|
proxy_pass http://app:3000;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
}
|
|
}
|