@cicore/cli 1.0.0

package/templates/vhost.conf.tmpl

@@ -0,0 +1,446 @@
+# ciCore Domain Config - {{DOMAIN}} -> {{CORE}}
+# CDN URL: https://cdn.{{DOMAIN}}/CoreUI/latest
+# Generated by: vu setup (nginxWriteVhost primitive, host-aware multi-core)
+# API: api.{{DOMAIN}} -> PHP backend (HTTPS)
+# Web: {{DOMAIN}}, www.{{DOMAIN}} -> Nuxt frontend (HTTPS)
+# Tenants: *.{{DOMAIN}} (except api) -> Nuxt frontend (HTTPS)
+# Custom Domains: tenant.com (CNAME to tenant.{{DOMAIN}}) -> Nuxt frontend (HTTPS)
+# Wildcard SSL: Cloudflare Origin Certificate covers *.{{DOMAIN}}
+
+# ======================================================
+# CUSTOM DOMAIN → TENANT MAPPING
+# Tenants can use their own domains via Cloudflare CNAME
+# Example: tenant.com CNAME -> tenant.{{DOMAIN}}
+# ======================================================
+map $host $custom_domain_tenant {
+    default "";
+    # {{CUSTOM_DOMAIN_MAP}} - Placeholder for dynamic custom domain entries
+    # Example:
+    # "example.com"     "tenant1.{{DOMAIN}}";
+    # "mycompany.com"   "tenant2.{{DOMAIN}}";
+}
+
+# ======================================================
+# 0. CUSTOM DOMAIN API SUBDOMAIN (api.tenant.com -> PHP Backend)
+# API subdomain for custom domains - routes to PHP backend
+# ======================================================
+
+
+# ======================================================
+# 1. CUSTOM DOMAIN ROUTING (tenant.com -> tenant.{{DOMAIN}})
+# Tenants using custom domains via Cloudflare CNAME
+# ======================================================
+
+
+# ======================================================
+# 1. HTTP -> HTTPS Redirect (All domains)
+# ======================================================
+server {
+    listen 80;
+    server_name {{DOMAIN}} *.{{DOMAIN}};
+    
+    location /health {
+        access_log off;
+        return 200 "healthy\n";
+        add_header Content-Type text/plain;
+    }
+    
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+# ======================================================
+# 2. API SUBDOMAIN SERVER (api.{{DOMAIN}}) - HTTPS
+# ======================================================
+server {
+    listen 443 ssl;
+    http2 on;
+    server_name api.{{DOMAIN}};
+
+    ssl_certificate /etc/nginx/ssl/{{SSL_CERT_NAME}}.crt;
+    ssl_certificate_key /etc/nginx/ssl/{{SSL_CERT_NAME}}.key;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 10m;
+
+    client_max_body_size 25m;
+    server_tokens off;
+
+    # Security Headers
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+
+    location / {
+        # CORS Preflight
+        if ($request_method = 'OPTIONS') {
+            add_header 'Access-Control-Allow-Origin' $http_origin always;
+            add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, PATCH, DELETE, OPTIONS' always;
+            add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, X-Requested-With, X-CSRF-Token, X-Core-Path, X-Tenant-Host, Cache-Control, Accept' always;
+            add_header 'Access-Control-Allow-Credentials' 'true' always;
+            add_header 'Access-Control-Max-Age' '86400' always;
+            add_header 'Content-Type' 'text/plain; charset=utf-8' always;
+            add_header 'Content-Length' '0' always;
+            return 204;
+        }
+
+        add_header 'Access-Control-Allow-Origin' $http_origin always;
+        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, PATCH, DELETE, OPTIONS' always;
+        add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, X-Requested-With, X-CSRF-Token, X-Core-Path, X-Tenant-Host, Accept' always;
+        add_header 'Access-Control-Allow-Credentials' 'true' always;
+        add_header 'Access-Control-Expose-Headers' 'X-CSRF-Token' always;
+
+        fastcgi_pass php_backend;
+        fastcgi_param SCRIPT_FILENAME /var/www/public/index.php;
+        fastcgi_param CORE_PATH $core_path;
+        include fastcgi_params;
+        fastcgi_param REQUEST_URI $request_uri;
+        fastcgi_param SCRIPT_NAME /index.php;
+        fastcgi_param HTTP_HOST $host;
+        fastcgi_param HTTP_TENANT_HOST $host;
+        fastcgi_param HTTPS on;
+        fastcgi_param HTTP_X_FORWARDED_PROTO https;
+
+        fastcgi_connect_timeout 300s;
+        fastcgi_send_timeout 300s;
+        fastcgi_read_timeout 300s;
+        fastcgi_buffer_size 128k;
+        fastcgi_buffers 4 256k;
+        fastcgi_busy_buffers_size 256k;
+        fastcgi_temp_file_write_size 256k;
+    }
+}
+
+# ======================================================
+# 3. TENANT SUBDOMAIN SERVER (*.{{DOMAIN}} except api) - HTTPS
+# Wildcard subdomain - her tenant kendi subdomain'inde çalışır
+# ======================================================
+server {
+    listen 443 ssl;
+    http2 on;
+    server_name ~^(?!api\.)(?<subdomain>[^.]+)\.{{DOMAIN_REGEX}}$;
+
+    ssl_certificate /etc/nginx/ssl/{{SSL_CERT_NAME}}.crt;
+    ssl_certificate_key /etc/nginx/ssl/{{SSL_CERT_NAME}}.key;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 10m;
+
+    client_max_body_size 25m;
+    client_body_timeout 60s;
+    client_header_timeout 60s;
+    server_tokens off;
+
+    # Security Headers
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+
+    # Gzip Compression
+    gzip on;
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_comp_level 6;
+    gzip_min_length 1000;
+    gzip_types text/plain text/css text/xml text/javascript application/json application/javascript application/xml+rss application/rss+xml font/truetype font/opentype application/vnd.ms-fontobject image/svg+xml;
+
+    # Health Check
+    location /health {
+        access_log off;
+        return 200 "healthy\n";
+        add_header Content-Type text/plain;
+    }
+
+    # CDN Proxy for Nuxt Assets (/_nuxt/ -> CDN)
+    location ^~ /_nuxt/ {
+        proxy_pass http://nuxt_frontend;
+        proxy_ssl_server_name on;
+        proxy_cache_valid 200 365d;
+        proxy_cache_valid 404 1m;
+        add_header 'Cache-Control' 'public, max-age=31536000, immutable' always;
+        add_header 'Access-Control-Allow-Origin' '*' always;
+        proxy_hide_header 'Access-Control-Allow-Origin';
+        proxy_intercept_errors on;
+        error_page 404 = @nuxt_fallback_tenant;
+    }
+
+    # Fallback to Nuxt if CDN file not found
+    location @nuxt_fallback_tenant {
+        proxy_pass http://nuxt_frontend;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+    }
+
+    # Shared API Files
+    location ^~ /shared/ {
+        alias /home/cores/{{CORE}}/shared/;
+        autoindex off;
+        types { application/javascript js mjs; application/json json; }
+        default_type application/javascript;
+        add_header 'Access-Control-Allow-Origin' $http_origin always;
+        add_header 'Access-Control-Allow-Credentials' 'true' always;
+        add_header 'Cache-Control' 'public, max-age=3600, immutable' always;
+        try_files $uri =404;
+    }
+
+    # Vendor Libs
+    location ^~ /vendor/ {
+        alias /home/cores/{{CORE}}/shared/vendor/;
+        autoindex off;
+        types { application/javascript js mjs; }
+        default_type application/javascript;
+        add_header 'Access-Control-Allow-Origin' $http_origin always;
+        add_header 'Access-Control-Allow-Credentials' 'true' always;
+        add_header 'Cache-Control' 'public, max-age=31536000, immutable' always;
+        try_files $uri =404;
+    }
+
+    # Addon ESM Files
+    location ^~ /cores/ {
+        alias /home/cores/;
+        autoindex off;
+        types { application/javascript js mjs; application/json json; text/css css; text/html html vue; image/svg+xml svg; }
+        default_type application/javascript;
+        add_header 'Access-Control-Allow-Origin' $http_origin always;
+        add_header 'Access-Control-Allow-Credentials' 'true' always;
+        add_header 'X-Content-Type-Options' 'nosniff' always;
+        open_file_cache off;
+        try_files $uri =404;
+    }
+
+    # ================================================================
+    # Nuxt Icon API - Route to Nuxt (BEFORE general / route)
+    # Fixes: 404 errors for /api/_nuxt_icon/* requests
+    # ================================================================
+    location ^~ /api/_nuxt_icon/ {
+        proxy_pass http://nuxt_frontend;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+        # Cache icons for 1 day
+        proxy_cache_valid 200 1d;
+        add_header 'Cache-Control' 'public, max-age=86400' always;
+    }
+
+    # Frontend (Nuxt SSR) - Tenant subdomain olarak yönlendir
+    location / {
+        proxy_pass http://nuxt_frontend;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header X-Core-Path $core_path;
+        proxy_set_header X-Tenant-Host $host;
+        proxy_set_header X-Tenant-Subdomain $subdomain;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        proxy_connect_timeout 300s;
+        proxy_send_timeout 300s;
+        proxy_read_timeout 300s;
+        proxy_buffering off;
+        proxy_cache_bypass $http_upgrade;
+    }
+
+    # Deny Hidden Files
+    location ~ /\.(?!well-known) {
+        deny all;
+        access_log off;
+        log_not_found off;
+    }
+}
+
+# ======================================================
+# 4. MAIN WEB SERVER ({{DOMAIN}}, www.{{DOMAIN}}) - HTTPS
+# ======================================================
+server {
+    listen 443 ssl;
+    http2 on;
+    server_name {{DOMAIN}} www.{{DOMAIN}};
+
+    ssl_certificate /etc/nginx/ssl/{{SSL_CERT_NAME}}.crt;
+    ssl_certificate_key /etc/nginx/ssl/{{SSL_CERT_NAME}}.key;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 10m;
+
+    client_max_body_size 25m;
+    client_body_timeout 60s;
+    client_header_timeout 60s;
+    server_tokens off;
+
+    # Security Headers
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+
+    # Gzip Compression
+    gzip on;
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_comp_level 6;
+    gzip_min_length 1000;
+    gzip_types text/plain text/css text/xml text/javascript application/json application/javascript application/xml+rss application/rss+xml font/truetype font/opentype application/vnd.ms-fontobject image/svg+xml;
+
+    # Health Check
+    location /health {
+        access_log off;
+        return 200 "healthy\n";
+        add_header Content-Type text/plain;
+    }
+
+    # CDN Proxy for Nuxt Assets (/_nuxt/ -> CDN)
+    # Each core can use its own CDN URL from .env (NUXT_PUBLIC_CORE_CDN_URL)
+    location ^~ /_nuxt/ {
+        proxy_pass http://nuxt_frontend;
+        proxy_ssl_server_name on;
+        proxy_cache_valid 200 365d;
+        proxy_cache_valid 404 1m;
+        add_header 'Cache-Control' 'public, max-age=31536000, immutable' always;
+        add_header 'Access-Control-Allow-Origin' '*' always;
+        proxy_hide_header 'Access-Control-Allow-Origin';
+        proxy_intercept_errors on;
+        error_page 404 = @nuxt_fallback;
+    }
+
+    # Fallback to Nuxt if CDN file not found
+    location @nuxt_fallback {
+        proxy_pass http://nuxt_frontend;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+    }
+
+    # Shared API Files
+    location ^~ /shared/ {
+        alias /home/cores/{{CORE}}/shared/;
+        autoindex off;
+        types { application/javascript js mjs; application/json json; }
+        default_type application/javascript;
+        add_header 'Access-Control-Allow-Origin' $http_origin always;
+        add_header 'Access-Control-Allow-Credentials' 'true' always;
+        add_header 'Cache-Control' 'public, max-age=3600, immutable' always;
+        try_files $uri =404;
+    }
+
+    # Vendor Libs
+    location ^~ /vendor/ {
+        alias /home/cores/{{CORE}}/shared/vendor/;
+        autoindex off;
+        types { application/javascript js mjs; }
+        default_type application/javascript;
+        add_header 'Access-Control-Allow-Origin' $http_origin always;
+        add_header 'Access-Control-Allow-Credentials' 'true' always;
+        add_header 'Cache-Control' 'public, max-age=31536000, immutable' always;
+        try_files $uri =404;
+    }
+
+    # Addon ESM Files
+    location ^~ /cores/ {
+        alias /home/cores/;
+        autoindex off;
+        types { application/javascript js mjs; application/json json; text/css css; text/html html vue; image/svg+xml svg; }
+        default_type application/javascript;
+        add_header 'Access-Control-Allow-Origin' $http_origin always;
+        add_header 'Access-Control-Allow-Credentials' 'true' always;
+        add_header 'X-Content-Type-Options' 'nosniff' always;
+        open_file_cache off;
+        try_files $uri =404;
+    }
+
+    # ================================================================
+    # Nuxt Icon API - Route to Nuxt (BEFORE general /api/ route)
+    # Fixes: 404 errors for /api/_nuxt_icon/* requests
+    # ================================================================
+    location ^~ /api/_nuxt_icon/ {
+        proxy_pass http://nuxt_frontend;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+        # Cache icons for 1 day
+        proxy_cache_valid 200 1d;
+        add_header 'Cache-Control' 'public, max-age=86400' always;
+    }
+
+    # API Endpoints (on web domain)
+    location ~ ^/(api|v1|v2|auth|system|system-settings|upload|addons|core_addons|core|analyzer|summary|metrics|jobs|worker|setup|tenant-manager|tenant-admin|user-admin|users|csrf-token|refresh|languages|institutions|sectors|security|odeme|builds|catalog|web-index|login|logout|me|public|status) {
+        # CORS Preflight
+        if ($request_method = 'OPTIONS') {
+            add_header 'Access-Control-Allow-Origin' $http_origin always;
+            add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, PATCH, DELETE, OPTIONS' always;
+            add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, X-Requested-With, X-CSRF-Token, X-Core-Path, X-Tenant-Host, Cache-Control, Accept' always;
+            add_header 'Access-Control-Allow-Credentials' 'true' always;
+            add_header 'Access-Control-Max-Age' '86400' always;
+            add_header 'Content-Type' 'text/plain; charset=utf-8' always;
+            add_header 'Content-Length' '0' always;
+            return 204;
+        }
+
+        add_header 'Access-Control-Allow-Origin' $http_origin always;
+        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, PATCH, DELETE, OPTIONS' always;
+        add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, X-Requested-With, X-CSRF-Token, X-Core-Path, X-Tenant-Host, Accept' always;
+        add_header 'Access-Control-Allow-Credentials' 'true' always;
+        add_header 'Access-Control-Expose-Headers' 'X-CSRF-Token' always;
+
+        fastcgi_pass php_backend;
+        fastcgi_param SCRIPT_FILENAME /var/www/public/index.php;
+        fastcgi_param CORE_PATH $core_path;
+        include fastcgi_params;
+        fastcgi_param REQUEST_URI $request_uri;
+        fastcgi_param SCRIPT_NAME /index.php;
+        fastcgi_param HTTP_HOST $host;
+        fastcgi_param HTTP_TENANT_HOST $host;
+        fastcgi_param HTTPS on;
+        fastcgi_param HTTP_X_FORWARDED_PROTO https;
+
+        fastcgi_connect_timeout 300s;
+        fastcgi_send_timeout 300s;
+        fastcgi_read_timeout 300s;
+        fastcgi_buffer_size 128k;
+        fastcgi_buffers 4 256k;
+        fastcgi_busy_buffers_size 256k;
+        fastcgi_temp_file_write_size 256k;
+    }
+
+    # Frontend (Nuxt SSR)
+    location / {
+        proxy_pass http://nuxt_frontend;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header X-Core-Path $core_path;
+        proxy_set_header X-Tenant-Host $host;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        proxy_connect_timeout 300s;
+        proxy_send_timeout 300s;
+        proxy_read_timeout 300s;
+        proxy_buffering off;
+        proxy_cache_bypass $http_upgrade;
+    }
+
+    # Deny Hidden Files
+    location ~ /\.(?!well-known) {
+        deny all;
+        access_log off;
+        log_not_found off;
+    }
+}