Thomas Peterson
79e996ab03
- Caddy ersetzt den Hetzner-LB: terminiert TLS (Portal-Domain automatisch) und load-balanced per reverse_proxy über die App-Nodes. Für Custom-Domains (§11) On-Demand-TLS, autorisiert über GET /internal/tls-allowed. - TlsCheckController + DomainRepository::findVerifiedByHostname: erlaubt Zertifikate nur für Portal-Domain oder verifizierte Domains (Schutz vor Cert-Flooding). - Terraform: hcloud_load_balancer entfernt, Caddy-Server + Firewall (80/443) + cloud-init-caddy (Caddyfile templated mit Upstreams/Domain/ACME). - Optional Hetzner DNS via API (manage_dns): A-Record Portal + Wildcard → Caddy. - nginx.prod: /internal zu Symfony geroutet; APP_PORTAL_DOMAIN-Env. Validiert: Caddyfile (caddy validate), Terraform (validate), /internal/tls-allowed (200/403/400). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
40 lines
1.0 KiB
Plaintext
40 lines
1.0 KiB
Plaintext
# Routing auf dem App-Node:
|
|
# /api, /p, /t, /css, /bundles, /health → Symfony (PHP-FPM)
|
|
# alles andere → Vue-SPA (history-fallback)
|
|
server {
|
|
listen 80;
|
|
server_name _;
|
|
|
|
# Standard: SPA-Build
|
|
root /spa;
|
|
index index.html;
|
|
|
|
client_max_body_size 32m;
|
|
|
|
# Symfony-Pfade (API + serverseitige öffentliche Seiten + interne Endpunkte)
|
|
location ~ ^/(api|p|t|css|bundles|health|internal)(/|$) {
|
|
root /app/public;
|
|
try_files $uri /index.php$is_args$args;
|
|
}
|
|
|
|
location ~ ^/index\.php(/|$) {
|
|
root /app/public;
|
|
fastcgi_pass php:9000;
|
|
fastcgi_split_path_info ^(.+\.php)(/.*)$;
|
|
include fastcgi_params;
|
|
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
|
fastcgi_param DOCUMENT_ROOT $document_root;
|
|
internal;
|
|
}
|
|
|
|
# SPA-Routing (history mode)
|
|
location / {
|
|
try_files $uri /index.html;
|
|
}
|
|
|
|
# direkte .php-Aufrufe blockieren
|
|
location ~ \.php$ {
|
|
return 404;
|
|
}
|
|
}
|