@cicore/cli 1.0.0

package/dist/lib/nginx-config.js

@@ -0,0 +1,736 @@
+/**
+ * CiCore CLI - Nginx Configuration Manager
+ *
+ * Dynamically manages nginx config for multi-domain setup:
+ * - CORS origin mapping
+ * - Domain to Core mapping
+ * - SSL certificates
+ * - Server blocks
+ */
+// ============================================
+// PARSER - Extract current domains from config
+// ============================================
+/**
+ * Parse existing nginx config and extract domain configurations
+ */
+export function parseNginxConfig(configContent) {
+    const domains = [];
+    // Extract from CORS map
+    const corsRegex = /"\~\^https\?:\/\/\(www\\\.\)\?([a-zA-Z0-9.-]+)\$"/g;
+    let match;
+    const foundDomains = new Set();
+    while ((match = corsRegex.exec(configContent)) !== null) {
+        foundDomains.add(match[1].replace(/\\\./g, '.'));
+    }
+    // Extract domain-core mappings
+    const domainCoreRegex = /^\s+([a-zA-Z0-9.-]+)\s+(core\d+);/gm;
+    const domainCoreMap = new Map();
+    while ((match = domainCoreRegex.exec(configContent)) !== null) {
+        const domain = match[1];
+        const core = match[2];
+        if (!domain.startsWith('www.') && !domain.startsWith('api.') && !domain.startsWith('~')) {
+            domainCoreMap.set(domain, core);
+        }
+    }
+    // Extract SSL cert name
+    const sslRegex = /ssl_certificate\s+\/etc\/nginx\/ssl\/([a-zA-Z0-9-]+)\.crt/;
+    const sslMatch = configContent.match(sslRegex);
+    const defaultSslCert = sslMatch ? sslMatch[1] : 'default';
+    // Build domain configs
+    for (const [domain, core] of domainCoreMap) {
+        domains.push({
+            domain,
+            coreName: core,
+            sslCertName: defaultSslCert,
+        });
+    }
+    return domains;
+}
+/**
+ * List domains currently configured in nginx
+ */
+export function listDomainsFromConfig(configContent) {
+    const domains = [];
+    // Extract domain-core mappings from map block
+    const mapBlockRegex = /map \$host \$target_core \{([\s\S]*?)\}/;
+    const mapMatch = configContent.match(mapBlockRegex);
+    if (mapMatch) {
+        const mapContent = mapMatch[1];
+        const domainRegex = /^\s+([a-zA-Z0-9.-]+)\s+(core\d+);/gm;
+        let match;
+        while ((match = domainRegex.exec(mapContent)) !== null) {
+            const domain = match[1];
+            const core = match[2];
+            // Only include root domains (not www., api., or regex patterns)
+            if (!domain.startsWith('www.') && !domain.startsWith('api.') && !domain.startsWith('~')) {
+                domains.push({ domain, core });
+            }
+        }
+    }
+    return domains;
+}
+// ============================================
+// GENERATOR - Create config sections
+// ============================================
+/**
+ * Generate CORS origin map entries for a domain
+ */
+export function generateCorsEntries(domain) {
+    const escaped = domain.replace(/\./g, '\\.');
+    return `    "~^https?://(www\\.)?${escaped}$" $http_origin;
+    "~^https?://api\\.${escaped}$" $http_origin;
+    "~^https?://.*\\.${escaped}$" $http_origin;`;
+}
+/**
+ * Generate domain-to-core map entries
+ */
+export function generateDomainCoreEntries(domain, coreName) {
+    return `    ${domain}       ${coreName};
+    www.${domain}   ${coreName};
+    api.${domain}   ${coreName};`;
+}
+/**
+ * Generate tenant subdomain regex entry
+ */
+export function generateTenantRegex(domain, coreName) {
+    const escaped = domain.replace(/\./g, '\\.');
+    return `    ~^.+\\.${escaped}$   ${coreName};`;
+}
+/**
+ * Generate core path map entry
+ */
+export function generateCorePathEntry(coreName) {
+    return `    ${coreName} /var/www/cores/${coreName};`;
+}
+// ============================================
+// MODIFIER - Add/Remove domains
+// ============================================
+/**
+ * Add a new domain to nginx config
+ */
+export function addDomainToConfig(configContent, domain, coreName, sslCertName) {
+    let newConfig = configContent;
+    // 1. Add CORS entries
+    const corsMapEnd = newConfig.indexOf('    "" "https://');
+    if (corsMapEnd > 0) {
+        const corsEntries = generateCorsEntries(domain);
+        newConfig = newConfig.slice(0, corsMapEnd) + corsEntries + '\n' + newConfig.slice(corsMapEnd);
+    }
+    // 2. Add domain-core mapping
+    const domainMapRegex = /(map \$host \$target_core \{[\s\S]*?)(    default\s+core\d+;)/;
+    const domainMapMatch = newConfig.match(domainMapRegex);
+    if (domainMapMatch) {
+        const domainEntries = `\n    ${domain}       ${coreName};\n    www.${domain}   ${coreName};\n    api.${domain}   ${coreName};\n\n    # Tenant subdomainleri\n    ~^.+\\.${domain.replace(/\./g, '\\.')}$   ${coreName};\n\n`;
+        newConfig = newConfig.replace(domainMapRegex, `$1${domainEntries}    default ${coreName};`);
+    }
+    // 3. Add core path if new core
+    const corePathRegex = new RegExp(`${coreName} /var/www/cores/${coreName};`);
+    if (!corePathRegex.test(newConfig)) {
+        const corePathMapEnd = newConfig.indexOf('}\n\n# ======', newConfig.indexOf('map $target_core $core_path'));
+        if (corePathMapEnd > 0) {
+            const corePathEntry = `    ${coreName} /var/www/cores/${coreName};\n`;
+            newConfig = newConfig.slice(0, corePathMapEnd) + corePathEntry + newConfig.slice(corePathMapEnd);
+        }
+    }
+    // 4. Add to API server block server_name
+    const apiServerNameRegex = /(server_name\s+)(api\.[a-zA-Z0-9.-]+(?:\s+api\.[a-zA-Z0-9.-]+)*)(;)/;
+    const apiMatch = newConfig.match(apiServerNameRegex);
+    if (apiMatch && !apiMatch[2].includes(`api.${domain}`)) {
+        newConfig = newConfig.replace(apiServerNameRegex, `$1$2 api.${domain}$3`);
+    }
+    // 5. Add to tenant subdomain server block
+    const tenantServerRegex = /(server_name\s+)(~\^\(\?!api\\\.\)\(\?<subdomain>\[\^.\]\+\)\\\.[\w.-]+\\\.\w+\$(?:\s+~\^\(\?!api\\\.\)\(\?<subdomain>\[\^.\]\+\)\\\.[\w.-]+\\\.\w+\$)*)(;)/;
+    const tenantMatch = newConfig.match(tenantServerRegex);
+    if (tenantMatch) {
+        const escapedDomain = domain.replace(/\./g, '\\.');
+        if (!tenantMatch[2].includes(escapedDomain)) {
+            const newTenantRegex = `~^(?!api\\.)(?<subdomain>[^.]+)\\.${escapedDomain}$`;
+            newConfig = newConfig.replace(tenantServerRegex, `$1$2\n                ${newTenantRegex}$3`);
+        }
+    }
+    // 6. Add to main web server block
+    const mainServerRegex = /(# 9\. ANA WEB SERVER[\s\S]*?server_name\s+)([a-zA-Z0-9.-]+(?:\s+[a-zA-Z0-9.-]+)*)(;)/;
+    const mainMatch = newConfig.match(mainServerRegex);
+    if (mainMatch && !mainMatch[2].includes(domain)) {
+        newConfig = newConfig.replace(mainServerRegex, `$1$2 ${domain} www.${domain}$3`);
+    }
+    return newConfig;
+}
+/**
+ * Remove a domain from nginx config
+ */
+export function removeDomainFromConfig(configContent, domain) {
+    let newConfig = configContent;
+    const escaped = domain.replace(/\./g, '\\.');
+    // 1. Remove CORS entries
+    const corsRegex = new RegExp(`\\s*"~\\^https\\?://\\(www\\\\\\.\\)\\?${escaped}\\$" \\$http_origin;\\n`, 'g');
+    newConfig = newConfig.replace(corsRegex, '');
+    const corsApiRegex = new RegExp(`\\s*"~\\^https\\?://api\\\\.${escaped}\\$" \\$http_origin;\\n`, 'g');
+    newConfig = newConfig.replace(corsApiRegex, '');
+    const corsWildcardRegex = new RegExp(`\\s*"~\\^https\\?://\\.\\*\\\\.${escaped}\\$" \\$http_origin;\\n`, 'g');
+    newConfig = newConfig.replace(corsWildcardRegex, '');
+    // 2. Remove domain-core mapping
+    const domainMapRegex = new RegExp(`\\s*${domain}\\s+core\\d+;\\n`, 'g');
+    newConfig = newConfig.replace(domainMapRegex, '');
+    const wwwMapRegex = new RegExp(`\\s*www\\.${domain}\\s+core\\d+;\\n`, 'g');
+    newConfig = newConfig.replace(wwwMapRegex, '');
+    const apiMapRegex = new RegExp(`\\s*api\\.${domain}\\s+core\\d+;\\n`, 'g');
+    newConfig = newConfig.replace(apiMapRegex, '');
+    // 3. Remove tenant regex
+    const tenantRegex = new RegExp(`\\s*~\\^\\.\+\\\\.${escaped}\\$\\s+core\\d+;\\n`, 'g');
+    newConfig = newConfig.replace(tenantRegex, '');
+    // 4. Remove from API server_name
+    const apiServerRegex = new RegExp(`\\s*api\\.${domain}`, 'g');
+    newConfig = newConfig.replace(apiServerRegex, '');
+    // 5. Remove from tenant server_name
+    const tenantServerRegex = new RegExp(`\\s*~\\^\\(\\?!api\\\\.\\)\\(\\?<subdomain>\\[\\^.\\]\\+\\)\\\\.${escaped}\\$`, 'g');
+    newConfig = newConfig.replace(tenantServerRegex, '');
+    // 6. Remove from main server_name
+    const mainServerRegex = new RegExp(`\\s*${domain}`, 'g');
+    newConfig = newConfig.replace(mainServerRegex, '');
+    const wwwServerRegex = new RegExp(`\\s*www\\.${domain}`, 'g');
+    newConfig = newConfig.replace(wwwServerRegex, '');
+    return newConfig;
+}
+/**
+ * Update SSL certificate references in config
+ */
+export function updateSSLCertInConfig(configContent, certName) {
+    let newConfig = configContent;
+    // Update all ssl_certificate directives
+    newConfig = newConfig.replace(/ssl_certificate\s+\/etc\/nginx\/ssl\/[a-zA-Z0-9-]+\.crt;/g, `ssl_certificate /etc/nginx/ssl/${certName}.crt;`);
+    newConfig = newConfig.replace(/ssl_certificate_key\s+\/etc\/nginx\/ssl\/[a-zA-Z0-9-]+\.key;/g, `ssl_certificate_key /etc/nginx/ssl/${certName}.key;`);
+    return newConfig;
+}
+/**
+ * Update default CORS origin in config
+ */
+export function updateDefaultCorsOrigin(configContent, domain) {
+    let newConfig = configContent;
+    // Update default in CORS map
+    newConfig = newConfig.replace(/default "https:\/\/[a-zA-Z0-9.-]+";/, `default "https://${domain}";`);
+    // Update empty origin fallback
+    newConfig = newConfig.replace(/"" "https:\/\/[a-zA-Z0-9.-]+";/, `"" "https://${domain}";`);
+    return newConfig;
+}
+// ============================================
+// VALIDATOR
+// ============================================
+/**
+ * Validate nginx config syntax (basic check)
+ */
+export function validateNginxConfig(configContent) {
+    const errors = [];
+    // Check for balanced braces
+    const openBraces = (configContent.match(/{/g) || []).length;
+    const closeBraces = (configContent.match(/}/g) || []).length;
+    if (openBraces !== closeBraces) {
+        errors.push(`Unbalanced braces: ${openBraces} open, ${closeBraces} close`);
+    }
+    // Check for required sections
+    if (!configContent.includes('map $http_origin $cors_origin')) {
+        errors.push('Missing CORS origin map');
+    }
+    if (!configContent.includes('map $host $target_core')) {
+        errors.push('Missing domain-core map');
+    }
+    if (!configContent.includes('upstream php_backend')) {
+        errors.push('Missing PHP upstream');
+    }
+    if (!configContent.includes('upstream nuxt_frontend')) {
+        errors.push('Missing Nuxt upstream');
+    }
+    return {
+        valid: errors.length === 0,
+        errors,
+    };
+}
+// ============================================
+// FULL CONFIG GENERATOR
+// ============================================
+/**
+ * Generate a complete nginx config from domain list
+ */
+export function generateFullNginxConfig(domains) {
+    if (domains.length === 0) {
+        throw new Error('At least one domain is required');
+    }
+    const primaryDomain = domains[0].domain;
+    const primaryCert = domains[0].sslCertName;
+    // Generate CORS entries
+    const corsEntries = domains.map(d => generateCorsEntries(d.domain)).join('\n');
+    // Generate domain-core map entries
+    const domainCoreEntries = domains.map(d => {
+        return `    # ${d.domain} → ${d.coreName}
+    ${d.domain}       ${d.coreName};
+    www.${d.domain}   ${d.coreName};
+    api.${d.domain}   ${d.coreName};`;
+    }).join('\n\n');
+    // Generate tenant regex entries
+    const tenantRegexEntries = domains.map(d => {
+        const escaped = d.domain.replace(/\./g, '\\.');
+        return `    ~^.+\\.${escaped}$   ${d.coreName};`;
+    }).join('\n');
+    // Generate core paths
+    const uniqueCores = [...new Set(domains.map(d => d.coreName))];
+    const corePathEntries = uniqueCores.map(c => `    ${c} /var/www/cores/${c};`).join('\n');
+    // Generate server_name lists
+    const apiServerNames = domains.map(d => `api.${d.domain}`).join(' ');
+    const tenantServerNames = domains.map(d => {
+        const escaped = d.domain.replace(/\./g, '\\.');
+        return `~^(?!api\\.)(?<subdomain>[^.]+)\\.${escaped}$`;
+    }).join('\n                ');
+    const mainServerNames = domains.flatMap(d => [d.domain, `www.${d.domain}`]).join(' ');
+    return `##
+## VUCORE GLOBAL NGINX ROUTER
+## Multi-Core + Multi-Tenant Yönetim Sistemi
+## Generated by CiCore CLI
+##
+
+# ======================================================
+# 0. CORS Origin Mapping (Dynamic CORS Support)
+# ======================================================
+map $http_origin $cors_origin {
+    default "https://${primaryDomain}";
+${corsEntries}
+    "" "https://${primaryDomain}";
+    "null" "null";
+}
+
+# ======================================================
+# 0.1. Addon Cache Control Map
+# ======================================================
+map $uri $addon_cache_control {
+    default                         "public, max-age=31536000, immutable";
+    "~*entry\\.js$"                  "no-cache, no-store, must-revalidate";
+    "~*addon\\.json$"                "no-cache, no-store, must-revalidate";
+}
+
+# ======================================================
+# 1. Cloudflare Real-IP Ayarları
+# ======================================================
+set_real_ip_from 173.245.48.0/20;
+set_real_ip_from 103.21.244.0/22;
+set_real_ip_from 103.22.200.0/22;
+set_real_ip_from 103.31.4.0/22;
+set_real_ip_from 141.101.64.0/18;
+set_real_ip_from 108.162.192.0/18;
+set_real_ip_from 190.93.240.0/20;
+set_real_ip_from 188.114.96.0/20;
+set_real_ip_from 197.234.240.0/22;
+set_real_ip_from 198.41.128.0/17;
+set_real_ip_from 162.158.0.0/15;
+set_real_ip_from 104.16.0.0/13;
+set_real_ip_from 104.24.0.0/14;
+set_real_ip_from 172.64.0.0/13;
+set_real_ip_from 131.0.72.0/22;
+set_real_ip_from 2400:cb00::/32;
+set_real_ip_from 2606:4700::/32;
+set_real_ip_from 2803:f800::/32;
+set_real_ip_from 2405:b500::/32;
+set_real_ip_from 2405:8100::/32;
+set_real_ip_from 2a06:98c0::/29;
+set_real_ip_from 2c0f:f248::/32;
+real_ip_header CF-Connecting-IP;
+
+# ======================================================
+# 1.1. WebSocket Connection Upgrade Map
+# ======================================================
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    ''      close;
+}
+
+# ======================================================
+# 2. PORT 80 → HTTPS YÖNLENDİRMESİ
+# ======================================================
+server {
+    listen 80;
+    server_name _;
+
+    location /health {
+        access_log off;
+        return 200 "healthy\\n";
+        add_header Content-Type text/plain;
+    }
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+# ======================================================
+# 3. DOMAIN → CORE MAP
+# ======================================================
+map $host $target_core {
+${domainCoreEntries}
+
+    # Tenant subdomainleri
+${tenantRegexEntries}
+
+    default              ${domains[0].coreName};
+}
+
+# ======================================================
+# 4. CORE → PATH MAP
+# ======================================================
+map $target_core $core_path {
+${corePathEntries}
+}
+
+# ======================================================
+# 5. Tenant Host Pass-through
+# ======================================================
+map $host $tenant_api_host {
+    default $host;
+}
+
+# ======================================================
+# 6. UPSTREAM TANIMLARI
+# ======================================================
+upstream php_backend {
+    server cicore_php:9000;
+    keepalive 32;
+}
+
+upstream nuxt_frontend {
+    server cicore_nuxt:3000;
+    keepalive 64;
+}
+
+# ======================================================
+# 7. API SUBDOMAIN SERVER
+# ======================================================
+server {
+    listen 443 ssl http2;
+    server_name ${apiServerNames};
+
+    ssl_certificate /etc/nginx/ssl/${primaryCert}.crt;
+    ssl_certificate_key /etc/nginx/ssl/${primaryCert}.key;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 10m;
+
+    client_max_body_size 25m;
+
+    location / {
+        if ($request_method = 'OPTIONS') {
+            add_header 'Access-Control-Allow-Origin' $cors_origin always;
+            add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, PATCH, DELETE, OPTIONS' always;
+            add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, X-Requested-With, X-CSRF-Token, X-Core-Path, X-Tenant-Host, Cache-Control, Accept' always;
+            add_header 'Access-Control-Allow-Credentials' 'true' always;
+            add_header 'Access-Control-Max-Age' '86400' always;
+            add_header 'Content-Type' 'text/plain; charset=utf-8' always;
+            add_header 'Content-Length' '0' always;
+            return 204;
+        }
+
+        add_header 'Access-Control-Allow-Origin' $cors_origin always;
+        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, PATCH, DELETE, OPTIONS' always;
+        add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, X-Requested-With, X-CSRF-Token, X-Core-Path, X-Tenant-Host, Accept' always;
+        add_header 'Access-Control-Allow-Credentials' 'true' always;
+        add_header 'Access-Control-Expose-Headers' 'X-CSRF-Token' always;
+
+        fastcgi_pass php_backend;
+
+        fastcgi_param SCRIPT_FILENAME /var/www/public/index.php;
+        fastcgi_param CORE_PATH $core_path;
+
+        include fastcgi_params;
+
+        fastcgi_param REQUEST_URI       $request_uri;
+        fastcgi_param SCRIPT_NAME       /index.php;
+        fastcgi_param HTTP_HOST         $host;
+        fastcgi_param HTTP_TENANT_HOST  $tenant_api_host;
+        fastcgi_param HTTPS             on;
+        fastcgi_param HTTP_X_FORWARDED_PROTO https;
+
+        fastcgi_connect_timeout 300s;
+        fastcgi_send_timeout 300s;
+        fastcgi_read_timeout 300s;
+        fastcgi_buffer_size 128k;
+        fastcgi_buffers 4 256k;
+        fastcgi_busy_buffers_size 256k;
+        fastcgi_temp_file_write_size 256k;
+    }
+}
+
+# ======================================================
+# 8. TENANT SUBDOMAIN SERVER
+# ======================================================
+server {
+    listen 443 ssl http2;
+    server_name ${tenantServerNames};
+
+    ssl_certificate /etc/nginx/ssl/${primaryCert}.crt;
+    ssl_certificate_key /etc/nginx/ssl/${primaryCert}.key;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 10m;
+
+    client_max_body_size 25m;
+    client_body_timeout 60s;
+    client_header_timeout 60s;
+
+    access_log /var/log/nginx/tenant-access.log;
+    error_log /var/log/nginx/tenant-error.log warn;
+
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+
+    gzip on;
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_comp_level 6;
+    gzip_min_length 1000;
+    gzip_types text/plain text/css text/xml text/javascript application/json application/javascript application/xml+rss application/rss+xml font/truetype font/opentype application/vnd.ms-fontobject image/svg+xml;
+
+    server_tokens off;
+
+    location /health {
+        access_log off;
+        return 200 "healthy\\n";
+        add_header Content-Type text/plain;
+    }
+
+    location ^~ /shared/ {
+        alias /home/cores/$target_core/shared/;
+        autoindex off;
+        types {
+            application/javascript js mjs;
+            application/json json;
+        }
+        default_type application/javascript;
+        add_header 'Access-Control-Allow-Origin' $cors_origin always;
+        add_header 'Access-Control-Allow-Credentials' 'true' always;
+        add_header 'Cache-Control' 'public, max-age=3600, immutable' always;
+        try_files $uri =404;
+    }
+
+    location ^~ /vendor/ {
+        alias /home/cores/$target_core/shared/vendor/;
+        autoindex off;
+        types {
+            application/javascript js mjs;
+        }
+        default_type application/javascript;
+        add_header 'Access-Control-Allow-Origin' $cors_origin always;
+        add_header 'Access-Control-Allow-Credentials' 'true' always;
+        add_header 'Cache-Control' 'public, max-age=31536000, immutable' always;
+        try_files $uri =404;
+    }
+
+    location ^~ /cores/ {
+        alias /home/cores/;
+        autoindex off;
+        types {
+            application/javascript js mjs;
+            application/json       json;
+            text/css               css;
+            text/html              html vue;
+            image/svg+xml          svg;
+        }
+        default_type application/javascript;
+        add_header 'Access-Control-Allow-Origin' $cors_origin always;
+        add_header 'Access-Control-Allow-Credentials' 'true' always;
+        add_header 'Cache-Control' $addon_cache_control always;
+        add_header 'X-Content-Type-Options' 'nosniff' always;
+        open_file_cache off;
+        try_files $uri =404;
+    }
+
+    location / {
+        proxy_pass http://nuxt_frontend;
+
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header X-Core-Path $core_path;
+        proxy_set_header X-Tenant-Host $host;
+        proxy_set_header X-Tenant-Subdomain $subdomain;
+        proxy_http_version 1.1;
+
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+
+        proxy_connect_timeout 300s;
+        proxy_send_timeout 300s;
+        proxy_read_timeout 300s;
+
+        proxy_buffering off;
+        proxy_cache_bypass $http_upgrade;
+    }
+
+    location ~ /\\.(?!well-known) {
+        deny all;
+        access_log off;
+        log_not_found off;
+    }
+}
+
+# ======================================================
+# 9. ANA WEB SERVER
+# ======================================================
+server {
+    listen 443 ssl http2;
+    server_name ${mainServerNames};
+
+    ssl_certificate /etc/nginx/ssl/${primaryCert}.crt;
+    ssl_certificate_key /etc/nginx/ssl/${primaryCert}.key;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 10m;
+
+    client_max_body_size 25m;
+    client_body_timeout 60s;
+    client_header_timeout 60s;
+
+    access_log /var/log/nginx/access.log;
+    error_log /var/log/nginx/error.log warn;
+
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+
+    gzip on;
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_comp_level 6;
+    gzip_min_length 1000;
+    gzip_types text/plain text/css text/xml text/javascript application/json application/javascript application/xml+rss application/rss+xml font/truetype font/opentype application/vnd.ms-fontobject image/svg+xml;
+
+    server_tokens off;
+
+    location /health {
+        access_log off;
+        return 200 "healthy\\n";
+        add_header Content-Type text/plain;
+    }
+
+    location ^~ /shared/ {
+        alias /home/cores/$target_core/shared/;
+        autoindex off;
+        types {
+            application/javascript js mjs;
+            application/json json;
+        }
+        default_type application/javascript;
+        add_header 'Access-Control-Allow-Origin' $cors_origin always;
+        add_header 'Access-Control-Allow-Credentials' 'true' always;
+        add_header 'Cache-Control' 'public, max-age=3600, immutable' always;
+        try_files $uri =404;
+    }
+
+    location ^~ /vendor/ {
+        alias /home/cores/$target_core/shared/vendor/;
+        autoindex off;
+        types {
+            application/javascript js mjs;
+        }
+        default_type application/javascript;
+        add_header 'Access-Control-Allow-Origin' $cors_origin always;
+        add_header 'Access-Control-Allow-Credentials' 'true' always;
+        add_header 'Cache-Control' 'public, max-age=31536000, immutable' always;
+        try_files $uri =404;
+    }
+
+    location ^~ /cores/ {
+        alias /home/cores/;
+        autoindex off;
+        types {
+            application/javascript js mjs;
+            application/json       json;
+            text/css               css;
+            text/html              html vue;
+            image/svg+xml          svg;
+        }
+        default_type application/javascript;
+        add_header 'Access-Control-Allow-Origin' $cors_origin always;
+        add_header 'Access-Control-Allow-Credentials' 'true' always;
+        add_header 'Cache-Control' $addon_cache_control always;
+        add_header 'X-Content-Type-Options' 'nosniff' always;
+        open_file_cache off;
+        try_files $uri =404;
+    }
+
+    location ~ ^/(api|v1|v2|auth|system|system-settings|upload|addons|core_addons|core|analyzer|summary|metrics|jobs|worker|setup|tenant-manager) {
+        if ($request_method = 'OPTIONS') {
+            add_header 'Access-Control-Allow-Origin' $cors_origin always;
+            add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, PATCH, DELETE, OPTIONS' always;
+            add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, X-Requested-With, X-CSRF-Token, X-Core-Path, X-Tenant-Host, Cache-Control, Accept' always;
+            add_header 'Access-Control-Allow-Credentials' 'true' always;
+            add_header 'Access-Control-Max-Age' '86400' always;
+            add_header 'Content-Type' 'text/plain; charset=utf-8' always;
+            add_header 'Content-Length' '0' always;
+            return 204;
+        }
+
+        add_header 'Access-Control-Allow-Origin' $cors_origin always;
+        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, PATCH, DELETE, OPTIONS' always;
+        add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, X-Requested-With, X-CSRF-Token, X-Core-Path, X-Tenant-Host, Accept' always;
+        add_header 'Access-Control-Allow-Credentials' 'true' always;
+        add_header 'Access-Control-Expose-Headers' 'X-CSRF-Token' always;
+
+        fastcgi_pass php_backend;
+
+        fastcgi_param SCRIPT_FILENAME /var/www/public/index.php;
+        fastcgi_param CORE_PATH $core_path;
+
+        include fastcgi_params;
+
+        fastcgi_param REQUEST_URI       $request_uri;
+        fastcgi_param SCRIPT_NAME       /index.php;
+        fastcgi_param HTTP_HOST         $host;
+        fastcgi_param HTTP_TENANT_HOST  $tenant_api_host;
+        fastcgi_param HTTPS             on;
+        fastcgi_param HTTP_X_FORWARDED_PROTO https;
+
+        fastcgi_connect_timeout 300s;
+        fastcgi_send_timeout 300s;
+        fastcgi_read_timeout 300s;
+        fastcgi_buffer_size 128k;
+        fastcgi_buffers 4 256k;
+        fastcgi_busy_buffers_size 256k;
+        fastcgi_temp_file_write_size 256k;
+    }
+
+    location / {
+        proxy_pass http://nuxt_frontend;
+
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header X-Core-Path $core_path;
+        proxy_set_header X-Tenant-Host $tenant_api_host;
+        proxy_http_version 1.1;
+
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+
+        proxy_connect_timeout 300s;
+        proxy_send_timeout 300s;
+        proxy_read_timeout 300s;
+
+        proxy_buffering off;
+        proxy_cache_bypass $http_upgrade;
+    }
+
+    location ~ /\\.(?!well-known) {
+        deny all;
+        access_log off;
+        log_not_found off;
+    }
+}
+`;
+}
+//# sourceMappingURL=nginx-config.js.map