Coornhert
d3536c74a4
- Meilisearch v1.12 + Qdrant v1.13 toegevoegd aan docker-compose
- Env vars voor MEILI_URL/QDRANT_URL/MISTRAL_API_KEY/FORGEJO_API_TOKEN
- Nieuwe web vhost (wetgit.nl) via wetgit-web.conf.j2
- Systemd service-paden:
- wetgit.service → uvicorn wetgit.api.app:app
- wetgit-celery.service → celery -A wetgit.tasks
- WETGIT_GIT_REPOS_DIR verplaatst naar {{ app_dir }}/app
(data leeft op /opt/wetgit/app/rijk/)
- Nieuwe vault-secrets: meili_master_key, qdrant_api_key, mistral_api_key
51 lines
1.5 KiB
Django/Jinja
51 lines
1.5 KiB
Django/Jinja
# WetGIT frontend (wetgit.nl) — managed by WetGIT Ansible (not dt-platform)
|
|
# Do NOT edit manually
|
|
|
|
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
server_name {{ web_domain }};
|
|
|
|
location /.well-known/acme-challenge/ {
|
|
root /var/www/certbot;
|
|
}
|
|
|
|
location / {
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl http2;
|
|
listen [::]:443 ssl http2;
|
|
server_name {{ web_domain }};
|
|
|
|
ssl_certificate /etc/letsencrypt/live/{{ web_domain }}/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/{{ web_domain }}/privkey.pem;
|
|
|
|
# Security headers
|
|
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
|
|
# Frontend proxy (same FastAPI app serves the web UI)
|
|
location / {
|
|
proxy_pass http://{{ backend_host }}:{{ backend_port }};
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
|
proxy_read_timeout 120s;
|
|
proxy_connect_timeout 10s;
|
|
}
|
|
|
|
# Static assets (served by FastAPI/Starlette)
|
|
location /static/ {
|
|
proxy_pass http://{{ backend_host }}:{{ backend_port }}/static/;
|
|
proxy_set_header Host $host;
|
|
expires 1d;
|
|
add_header Cache-Control "public";
|
|
}
|
|
}
|