who_need_help/deploy/nginx

Staging reverse proxy

whoneedhelp.imalto.site.conf is the HTTP vhost consumed by Certbot's Nginx installer on the VPN gateway. It forwards HTTP and LiveView WebSocket traffic to the workstation at 10.8.0.14:4010.

The workstation's ignored .env must use:

PHX_HOST=whoneedhelp.imalto.site
PHX_SCHEME=https
PHX_URL_PORT=443
TRAEFIK_TRUSTED_IPS=10.8.0.1/32

The last setting allows forwarded headers only from the observed VPN address of the gateway. Do not replace it with Traefik's insecure forwarded-header mode.

The checked server currently uses the standard Ubuntu Nginx/Certbot layout. After copying the vhost to /home/simple/whoneedhelp.imalto.site.conf, install and enable it with root privileges:

sudo install -o root -g root -m 0644 \
  /home/simple/whoneedhelp.imalto.site.conf \
  /etc/nginx/sites-available/whoneedhelp.imalto.site
sudo ln -s \
  /etc/nginx/sites-available/whoneedhelp.imalto.site \
  /etc/nginx/sites-enabled/whoneedhelp.imalto.site
sudo nginx -t
sudo systemctl reload nginx
sudo certbot --nginx --redirect -d whoneedhelp.imalto.site
sudo nginx -t

If validation fails before certificate issuance, remove only the new symlink and file, validate the previous configuration, and reload:

sudo rm -f /etc/nginx/sites-enabled/whoneedhelp.imalto.site
sudo rm -f /etc/nginx/sites-available/whoneedhelp.imalto.site
sudo nginx -t
sudo systemctl reload nginx