From a3180ad23269565508420185eee9466f263549a9 Mon Sep 17 00:00:00 2001 From: Lacky1234union Date: Sun, 4 Oct 2026 16:19:19 +0300 Subject: [PATCH] chore(devops): HTTPS for dev.meditron.tenvex.ru, meditron.tenvex.ru on HTTP until its DNS record Co-Authored-By: Claude Opus 5.5 --- infra/deploy/docker-compose.server.yml | 2 +- infra/deploy/nginx-meditron.conf | 60 +++++++++++++++++++++++++- 2 files changed, 59 insertions(+), 3 deletions(-) diff --git a/infra/deploy/docker-compose.server.yml b/infra/deploy/docker-compose.server.yml index d195ed9..24a835f 100644 --- a/infra/deploy/docker-compose.server.yml +++ b/infra/deploy/docker-compose.server.yml @@ -23,7 +23,7 @@ services: - --browser.gatherUsageStats=false environment: API_BASE_URL: http://app:8000 - DASHBOARD_PUBLIC_URL: ${PUBLIC_URL:-http://localhost}/doctor + DASHBOARD_PUBLIC_URL: ${PUBLIC_URL:-https://dev.meditron.tenvex.ru}/doctor ports: !override - "127.0.0.1:8511:8501" restart: unless-stopped diff --git a/infra/deploy/nginx-meditron.conf b/infra/deploy/nginx-meditron.conf index ffcfd14..7f7120f 100644 --- a/infra/deploy/nginx-meditron.conf +++ b/infra/deploy/nginx-meditron.conf @@ -1,14 +1,70 @@ -# meditron.tenvex.ru — PTSRaiAgent prototype (synthetic data only). +# PTSRaiAgent prototype (synthetic data only) — shared host with vobot. # / patient web app (static, web/dist) # /api/ FastAPI (127.0.0.1:8010) # /doctor/ Streamlit doctor dashboard + demo console (127.0.0.1:8511, baseUrlPath=doctor) -# TLS: after the DNS A-record exists — certbot --nginx -d meditron.tenvex.ru +# dev.meditron.tenvex.ru — HTTPS (Let's Encrypt, certbot certonly --nginx, auto-renew). +# meditron.tenvex.ru — HTTP until its DNS record exists; then: certbot certonly --nginx -d meditron.tenvex.ru +# and move it into an HTTPS block like dev.meditron. map $http_upgrade $ptsr_connection_upgrade { default upgrade; '' close; } +server { + listen 80; + listen [::]:80; + server_name dev.meditron.tenvex.ru; + return 301 https://$host$request_uri; +} + +server { + listen 443 ssl; + listen [::]:443 ssl; + server_name dev.meditron.tenvex.ru; + + ssl_certificate /etc/letsencrypt/live/dev.meditron.tenvex.ru/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/dev.meditron.tenvex.ru/privkey.pem; + include /etc/letsencrypt/options-ssl-nginx.conf; + ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; + + access_log /var/log/nginx/ptsr-access.log; + client_max_body_size 5m; + + root /srv/ptsr/app/web/dist; + index index.html; + + location / { + try_files $uri $uri/ /index.html; + } + + location /api/ { + proxy_pass http://127.0.0.1:8010; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_read_timeout 120s; # chat agent + scheduler replay on clock advance + } + + location ~ ^/(docs|openapi.json|health)$ { + proxy_pass http://127.0.0.1:8010; + proxy_set_header Host $host; + } + + location /doctor/ { + proxy_pass http://127.0.0.1:8511; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $ptsr_connection_upgrade; + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_read_timeout 86400s; + proxy_buffering off; + } +} + server { listen 80; listen [::]:80; -- 2.54.0