# Staging reverse proxy

`whoneedhelp.imalto.site.conf` is the HTTP vhost consumed by Certbot's Nginx
installer on the VPN gateway. It forwards HTTP and LiveView WebSocket traffic
to the workstation at `10.8.0.14:4010`.

The workstation's ignored `.env` must use:

```dotenv
PHX_HOST=whoneedhelp.imalto.site
PHX_SCHEME=https
PHX_URL_PORT=443
TRAEFIK_TRUSTED_IPS=10.8.0.1/32
```

The last setting allows forwarded headers only from the observed VPN address of
the gateway. Do not replace it with Traefik's insecure forwarded-header mode.

The checked server currently uses the standard Ubuntu Nginx/Certbot layout.
After copying the vhost to `/home/simple/whoneedhelp.imalto.site.conf`, install
and enable it with root privileges:

```bash
sudo install -o root -g root -m 0644 \
  /home/simple/whoneedhelp.imalto.site.conf \
  /etc/nginx/sites-available/whoneedhelp.imalto.site
sudo ln -s \
  /etc/nginx/sites-available/whoneedhelp.imalto.site \
  /etc/nginx/sites-enabled/whoneedhelp.imalto.site
sudo nginx -t
sudo systemctl reload nginx
sudo certbot --nginx --redirect -d whoneedhelp.imalto.site
sudo nginx -t
```

If validation fails before certificate issuance, remove only the new symlink
and file, validate the previous configuration, and reload:

```bash
sudo rm -f /etc/nginx/sites-enabled/whoneedhelp.imalto.site
sudo rm -f /etc/nginx/sites-available/whoneedhelp.imalto.site
sudo nginx -t
sudo systemctl reload nginx
```