@webship.co/workspace 1.0.0-beta1 → 1.0.0-beta2

package/core/workspace-app/.ddev/config.yaml

@@ -0,0 +1,400 @@
+name: workspace
+type: generic
+docroot: public
+php_version: "8.3"
+webserver_type: nginx-fpm
+xdebug_enabled: false
+additional_hostnames:
+- "*.workspace"
+- "*.products.workspace"
+- "*.dev.workspace"
+- "*.test.workspace"
+- "*.demos.workspace"
+- "*.sandboxes.workspace"
+- "*.profiles.workspace"
+- "*.site-templates.workspace"
+- "*.modules.workspace"
+- "*.themes.workspace"
+- "*.libraries.workspace"
+- "*.recipes.workspace"
+- "*.projects.workspace"
+- "*.specs.workspace"
+- "*.graphs.workspace"
+- "*.rag.workspace"
+- "*.ai-agents.workspace"
+- "*.ai-skills.workspace"
+- "*.ai-commands.workspace"
+- "*.ai-prompts.workspace"
+- "*.designs.workspace"
+- "*.images.workspace"
+- "*.videos.workspace"
+- "*.audio.workspace"
+- "*.avatars.workspace"
+- "*.docs.workspace"
+- "*.commands.workspace"
+- "*.worklogs.workspace"
+additional_fqdns: []
+
+# Every URL this project serves is https, signed by mkcert's local CA. A machine
+# that has never run mkcert has no CA, so the first thing a new install sees is
+# ERR_CERT_AUTHORITY_INVALID rather than the dashboard — and `ddev start` says so
+# only in a warning, in the middle of a long build log, where it is missed.
+#
+# exec-host, because trust stores live on the host, not in the container. The
+# script is idempotent and silent when there is nothing to do, so it costs a
+# fraction of a second on every later start.
+hooks:
+  # BEFORE the container exists: Docker creates any missing bind-mount source as a
+  # root-owned directory, which quietly breaks the tool it was meant to share — and
+  # takes ~/.local/bin with it, so nothing can install a user binary there either.
+  # Creating those paths as you first, and dropping the twg mount while twg is not
+  # installed, is what keeps a fresh machine clean.
+  pre-start:
+    # `|| true`: this reports damage it cannot fix without root, and a start must not
+    # fail because a path needs a chown. The message is the point, not the exit code.
+    - exec-host: bash "${DDEV_APPROOT}/../scripts/host-mounts.sh" --quiet || true
+  post-start:
+    - exec-host: bash "${DDEV_APPROOT}/../scripts/trust-https.sh" --quiet
+    # Every web_extra_daemon that is not running, started. Normally a no-op.
+    #
+    # DDEV starts these itself at the end of `ddev start` — and that step RACES supervisord
+    # coming up. When it loses, ddev prints
+    #
+    #   Unable to start web_extra_daemons using supervisorctl,
+    #   stdout=error: <class 'http.client.RemoteDisconnected'> …
+    #
+    # and then says **Successfully started workspace** anyway. The daemons are left
+    # "Not started", so nginx answers **502 Bad Gateway** — the proxy is up and the thing
+    # behind it never came up. A start that reports success and leaves the dashboard dead is
+    # the worst shape a failure can take, because nothing suggests the start is where to look.
+    # Reproduced on this machine, and fixed by this line.
+    #
+    # supervisord is asked which daemons are actually down rather than everything being
+    # started blindly, so a healthy start does nothing; `|| true` because a daemon that will
+    # not come up is still not a reason to fail the project's start — the 502 says the rest.
+    - exec: supervisorctl status webextradaemons:* 2>/dev/null | grep -v RUNNING | awk '{print $1}' | xargs -r supervisorctl start || true
+database:
+    type: mariadb
+    version: "10.11"
+use_dns_when_possible: true
+composer_version: "2"
+web_environment: []
+# The workspace packages are Yarn Berry: 63 of them carry `packageManager: yarn@4.9.3`, and yarn
+# refuses to run their scripts under the 1.22 shim without corepack. This container is where a
+# PACKAGE's checks run — a product, a module or a theme has no DDEV project of its own — so the
+# checks verb cannot work here without it.
+corepack_enable: true
+omit_containers: [db]
+nodejs_version: "24"
+webimage_extra_packages: [screen]
+web_extra_daemons:
+- name: "workspace-app"
+  # `sg docker` runs the app with the container's "docker" group (GID matched
+  # to the host's in the Dockerfile) actually ACTIVE — supervisord launches
+  # daemons without initgroups(), so group membership listed in /etc/group
+  # alone never applies, and DDEV's start scripts reset any primary-GID
+  # change made at image build time. The ddev binary refuses to run as root,
+  # so sudo is not an option here.
+  command: "sg docker -c 'npm install && npm start'"
+  directory: /var/www/html
+# The Web IDE: VS Code in the browser, at https://ide.workspace.ddev.site.
+#
+# Bound to LOOPBACK on purpose — the only way in is the ide.* vhost in
+# .ddev/nginx_full/nginx-site.conf, so it is reachable exactly where the dashboard is and
+# nowhere else. `--auth none` because the dashboard itself has no login: adding a second
+# password in front of one door of an unauthenticated tool would be theatre, and the
+# dashboard already offers a browser terminal at /terminal/<session>. If the hub is ever
+# put on a public domain, BOTH need real auth in front of them — see the README.
+#
+# Its state lives under the workspace tree (gitignored) rather than in the container, so
+# settings, keybindings and installed extensions survive an image rebuild.
+- name: "code-server"
+  # The flags live in the script, which also seeds default settings on a machine that
+  # has none — including turning Workspace Trust off, without which the terminal
+  # refuses to start until a prompt is answered for every folder.
+  command: "bash scripts/code-server-start.sh"
+  directory: /var/www/html
+
+# Key features of DDEV's config.yaml:
+
+# name: <projectname> # Name of the project, automatically provides
+#   http://projectname.ddev.site and https://projectname.ddev.site
+# If the name is omitted, the project will take the name of the enclosing directory,
+# which is useful if you want to have a copy of the project side by side with this one.
+
+# type: <projecttype>  # backdrop, cakephp, craftcms, drupal, drupal6, drupal7, drupal8, drupal9, drupal10, drupal11, generic, laravel, magento, magento2, php, shopware6, silverstripe, symfony, typo3, wordpress
+# See https://ddev.readthedocs.io/en/stable/users/quickstart/ for more
+# information on the different project types
+
+# docroot: <relative_path> # Relative path to the directory containing index.php.
+
+# php_version: "8.3"  # PHP version to use, "5.6" through "8.4"
+
+# You can explicitly specify the webimage but this
+# is not recommended, as the images are often closely tied to DDEV's' behavior,
+# so this can break upgrades.
+
+# webimage: <docker_image>  # nginx/php docker image.
+
+# database:
+#   type: <dbtype> # mysql, mariadb, postgres
+#   version: <version> # database version, like "10.11" or "8.0"
+#   MariaDB versions can be 5.5-10.8, 10.11, 11.4, 11.8
+#   MySQL versions can be 5.5-8.0, 8.4
+#   PostgreSQL versions can be 9-17
+
+# router_http_port: <port>  # Port to be used for http (defaults to global configuration, usually 80)
+# router_https_port: <port> # Port for https (defaults to global configuration, usually 443)
+
+# xdebug_enabled: false  # Set to true to enable Xdebug and "ddev start" or "ddev restart"
+# Note that for most people the commands
+# "ddev xdebug" to enable Xdebug and "ddev xdebug off" to disable it work better,
+# as leaving Xdebug enabled all the time is a big performance hit.
+
+# xhgui_https_port: 8142
+# Can be used to change the router https port for xhgui application
+# Very rarely used
+
+# xhgui_http_port: 8143
+# Can be used to change the router http port for xhgui application
+# Very rarely used
+
+# host_xhgui_port: 8142
+# Can be used to change the host binding port of the xhgui
+# application. Rarely used; only when port conflict and
+# bind_all_ports is used (normally with router disabled)
+
+# xhprof_enabled: false  # Set to true to enable Xhprof and "ddev start" or "ddev restart"
+# Note that for most people the commands
+# "ddev xhprof" to enable Xhprof and "ddev xhprof off" to disable it work better,
+# as leaving Xhprof enabled all the time is a big performance hit.
+
+# xhprof_mode: [prepend|xhgui|global]
+# Set to "xhgui" to enable XHGui features
+# "xhgui" will become default in a future major release
+
+# webserver_type: nginx-fpm, apache-fpm, generic
+
+# timezone: Europe/Berlin
+# If timezone is unset, DDEV will attempt to derive it from the host system timezone
+# using the $TZ environment variable or the /etc/localtime symlink.
+# This is the timezone used in the containers and by PHP;
+# it can be set to any valid timezone,
+# see https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
+# For example Europe/Dublin or MST7MDT
+
+# composer_root: <relative_path>
+# Relative path to the Composer root directory from the project root. This is
+# the directory which contains the composer.json and where all Composer related
+# commands are executed.
+
+# composer_version: "2"
+# You can set it to "" or "2" (default) for Composer v2 or "1" for Composer v1
+# to use the latest major version available at the time your container is built.
+# It is also possible to use each other Composer version channel. This includes:
+#   - 2.2 (latest Composer LTS version)
+#   - stable
+#   - preview
+#   - snapshot
+# Alternatively, an explicit Composer version may be specified, for example "2.2.18".
+# To reinstall Composer after the image was built, run "ddev debug rebuild".
+
+# nodejs_version: "22"
+# change from the default system Node.js version to any other version.
+# See https://ddev.readthedocs.io/en/stable/users/configuration/config/#nodejs_version for more information
+# and https://www.npmjs.com/package/n#specifying-nodejs-versions for the full documentation,
+# Note that using of 'ddev nvm' is discouraged because "nodejs_version" is much easier to use,
+# can specify any version, and is more robust than using 'nvm'.
+
+# corepack_enable: false
+# Change to 'true' to 'corepack enable' and gain access to latest versions of yarn/pnpm
+
+# additional_hostnames:
+#  - somename
+#  - someothername
+# would provide http and https URLs for "somename.ddev.site"
+# and "someothername.ddev.site".
+
+# additional_fqdns:
+#  - example.com
+#  - sub1.example.com
+# would provide http and https URLs for "example.com" and "sub1.example.com"
+# Please take care with this because it can cause great confusion.
+
+# upload_dirs: "custom/upload/dir"
+#
+# upload_dirs:
+#   - custom/upload/dir
+#   - ../private
+#
+# would set the destination paths for ddev import-files to <docroot>/custom/upload/dir
+# When Mutagen is enabled this path is bind-mounted so that all the files
+# in the upload_dirs don't have to be synced into Mutagen.
+
+# disable_upload_dirs_warning: false
+# If true, turns off the normal warning that says
+# "You have Mutagen enabled and your 'php' project type doesn't have upload_dirs set"
+
+# ddev_version_constraint: ""
+# Example:
+# ddev_version_constraint: ">= 1.22.4"
+# This will enforce that the running ddev version is within this constraint.
+# See https://github.com/Masterminds/semver#checking-version-constraints for
+# supported constraint formats
+
+# working_dir:
+#   web: /var/www/html
+#   db: /home
+# would set the default working directory for the web and db services.
+# These values specify the destination directory for ddev ssh and the
+# directory in which commands passed into ddev exec are run.
+
+# omit_containers: [db, ddev-ssh-agent]
+# Currently only these containers are supported. Some containers can also be
+# omitted globally in the ~/.ddev/global_config.yaml. Note that if you omit
+# the "db" container, several standard features of DDEV that access the
+# database container will be unusable. In the global configuration it is also
+# possible to omit ddev-router, but not here.
+
+# performance_mode: "global"
+# DDEV offers performance optimization strategies to improve the filesystem
+# performance depending on your host system. Should be configured globally.
+#
+# If set, will override the global config. Possible values are:
+#   - "global":  uses the value from the global config.
+#   - "none":    disables performance optimization for this project.
+#   - "mutagen": enables Mutagen for this project.
+#   - "nfs":     enables NFS for this project.
+#
+# See https://ddev.readthedocs.io/en/stable/users/install/performance/#nfs
+# See https://ddev.readthedocs.io/en/stable/users/install/performance/#mutagen
+
+# fail_on_hook_fail: False
+# Decide whether 'ddev start' should be interrupted by a failing hook
+
+# host_https_port: "59002"
+# The host port binding for https can be explicitly specified. It is
+# dynamic unless otherwise specified.
+# This is not used by most people, most people use the *router* instead
+# of the localhost port.
+
+# host_webserver_port: "59001"
+# The host port binding for the ddev-webserver can be explicitly specified. It is
+# dynamic unless otherwise specified.
+# This is not used by most people, most people use the *router* instead
+# of the localhost port.
+
+# host_db_port: "59002"
+# The host port binding for the ddev-dbserver can be explicitly specified. It is dynamic
+# unless explicitly specified.
+
+# mailpit_http_port: "8025"
+# mailpit_https_port: "8026"
+# The Mailpit ports can be changed from the default 8025 and 8026
+
+# host_mailpit_port: "8025"
+# The mailpit port is not normally bound on the host at all, instead being routed
+# through ddev-router, but it can be bound directly to localhost if specified here.
+
+# webimage_extra_packages: [php7.4-tidy, php-bcmath]
+# Extra Debian packages that are needed in the webimage can be added here
+
+# dbimage_extra_packages: [telnet,netcat]
+# Extra Debian packages that are needed in the dbimage can be added here
+
+# use_dns_when_possible: true
+# If the host has internet access and the domain configured can
+# successfully be looked up, DNS will be used for hostname resolution
+# instead of editing /etc/hosts
+# Defaults to true
+
+# project_tld: ddev.site
+# The top-level domain used for project URLs
+# The default "ddev.site" allows DNS lookup via a wildcard
+# If you prefer you can change this to "ddev.local" to preserve
+# pre-v1.9 behavior.
+
+# ngrok_args: --basic-auth username:pass1234
+# Provide extra flags to the "ngrok http" command, see
+# https://ngrok.com/docs/agent/config/v3/#agent-configuration or run "ngrok http -h"
+
+# disable_settings_management: false
+# If true, DDEV will not create CMS-specific settings files like
+# Drupal's settings.php/settings.ddev.php or TYPO3's additional.php
+# In this case the user must provide all such settings.
+
+# You can inject environment variables into the web container with:
+# web_environment:
+#     - SOMEENV=somevalue
+#     - SOMEOTHERENV=someothervalue
+
+# no_project_mount: false
+# (Experimental) If true, DDEV will not mount the project into the web container;
+# the user is responsible for mounting it manually or via a script.
+# This is to enable experimentation with alternate file mounting strategies.
+# For advanced users only!
+
+# bind_all_interfaces: false
+# If true, host ports will be bound on all network interfaces,
+# not the localhost interface only. This means that ports
+# will be available on the local network if the host firewall
+# allows it.
+
+# default_container_timeout: 120
+# The default time that DDEV waits for all containers to become ready can be increased from
+# the default 120. This helps in importing huge databases, for example.
+
+#web_extra_exposed_ports:
+#- name: nodejs
+#  container_port: 3000
+#  http_port: 2999
+#  https_port: 3000
+#- name: something
+#  container_port: 4000
+#  https_port: 4000
+#  http_port: 3999
+# Allows a set of extra ports to be exposed via ddev-router
+# Fill in all three fields even if you don’t intend to use the https_port!
+# If you don’t add https_port, then it defaults to 0 and ddev-router will fail to start.
+#
+# The port behavior on the ddev-webserver must be arranged separately, for example
+# using web_extra_daemons.
+# For example, with a web app on port 3000 inside the container, this config would
+# expose that web app on https://<project>.ddev.site:9999 and http://<project>.ddev.site:9998
+# web_extra_exposed_ports:
+#  - name: myapp
+#    container_port: 3000
+#    http_port: 9998
+#    https_port: 9999
+
+#web_extra_daemons:
+#- name: "http-1"
+#  command: "/var/www/html/node_modules/.bin/http-server -p 3000"
+#  directory: /var/www/html
+#- name: "http-2"
+#  command: "/var/www/html/node_modules/.bin/http-server /var/www/html/sub -p 3000"
+#  directory: /var/www/html
+
+# override_config: false
+# By default, config.*.yaml files are *merged* into the configuration
+# But this means that some things can't be overridden
+# For example, if you have 'use_dns_when_possible: true'' you can't override it with a merge
+# and you can't erase existing hooks or all environment variables.
+# However, with "override_config: true" in a particular config.*.yaml file,
+# 'use_dns_when_possible: false' can override the existing values, and
+# hooks:
+#   post-start: []
+# or
+# web_environment: []
+# or
+# additional_hostnames: []
+# can have their intended affect. 'override_config' affects only behavior of the
+# config.*.yaml file it exists in.
+
+# Many DDEV commands can be extended to run tasks before or after the
+# DDEV command is executed, for example "post-start", "post-import-db",
+# "pre-composer", "post-composer"
+# See https://ddev.readthedocs.io/en/stable/users/extend/custom-commands/ for more
+# information on the commands that can be extended and the tasks you can define
+# for them. Example:
+#hooks:

package/core/workspace-app/.ddev/docker-compose.dood.yaml

@@ -0,0 +1,45 @@
+services:
+  web:
+    # Docker-outside-of-Docker needs this process to be in the host's docker
+    # group, and DDEV pins the container to `user: 1000:1000` — which overrides
+    # whatever the Dockerfile did to /etc/passwd, so a build-time `usermod -g`
+    # never reaches the running process. group_add is granted by the kernel at
+    # container start, so it is in the process credentials before supervisord
+    # starts and is inherited by every daemon it spawns.
+    #
+    # The number is this machine's docker GID, so it is written by
+    # core/scripts/docker-gid.sh — install.sh runs it during setup and
+    # sync-tooling.sh runs it after mirroring, because this file is mirrored.
+    group_add:
+      - "999"
+    volumes:
+      # Docker-outside-of-Docker: talk to the host's real docker daemon so
+      # `ddev`/bash cmd-*.sh scripts run from inside this container manage
+      # sibling ddev projects exactly like they would on the host.
+      - /var/run/docker.sock:/var/run/docker.sock
+      # DDEV's project registry. Without it the `ddev` in here has its own empty
+      # ~/.ddev and knows only the project it is standing in — so `ddev list`
+      # returns 1 project instead of 12, and the dashboard reports every other
+      # project as Stopped no matter what it is really doing. The daemon is the
+      # host's; the registry that says where the projects live has to be too.
+      # Safe to share because the tree is bind-mounted at the SAME absolute path,
+      # so every approot in it resolves identically on both sides.
+      - ${HOME}/.ddev:${HOME}/.ddev
+      # Bind the whole workspace tree at the SAME absolute path the host
+      # uses, so WORKSPACE_ROOT and every cmd-*.sh script's
+      # references resolve identically whether run on the host or in here.
+      # ${HOME} is interpolated on the HOST when ddev invokes docker compose.
+      - ${HOME}/workspace:${HOME}/workspace
+      # Claude Code auth/config for the AI assistant chat.
+      - ${HOME}/.claude:${HOME}/.claude
+      - ${HOME}/.claude.json:${HOME}/.claude.json
+      # gh's auth, for reading and fetching from the private dev-ai-agents repo.
+      - ${HOME}/.config/gh:${HOME}/.config/gh
+    environment:
+      - WORKSPACE_ROOT=${HOME}/workspace
+      - WORKSPACE_PATH=${HOME}/workspace/core
+      - WORKSPACE_SCRIPTS=${HOME}/workspace/core/scripts
+      - WORKSPACE_CONFIG=${HOME}/workspace/core/config
+      # Without this, the `ddev` binary can't find its global config/project
+      # registry and fails with "Could not connect to a Docker provider".
+      - HOME=${HOME}

package/core/workspace-app/.ddev/docker-compose.plugin-jira-twg.yaml

@@ -0,0 +1,26 @@
+# The Teamwork Graph CLI, shared FROM THE HOST instead of copied into the image:
+# one binary, one OAuth session. Copying the config once split the rotating
+# refresh token between two installations and each invalidated the other —
+# mounting keeps a single owner, `twg login` on the host reaches the container
+# instantly, and both survive image rebuilds.
+#
+# The BIN DIRECTORY is mounted, not the twg file itself, and that is the whole
+# point of this shape. A single-file bind mount binds an INODE: `twg update`
+# on the host writes a new file, the container keeps pointing at the old one,
+# and the dashboard goes on running a version the server has stopped accepting
+# — visible only as "Update required" inside a workitems list, with nothing
+# saying the host binary was already current. Mounting the directory means the
+# container resolves the name on every call, so an update is live immediately.
+#
+# /usr/local/bin/twg in the image is a wrapper that execs this (see
+# .ddev/web-build/Dockerfile.workspace-app), so PATH still finds `twg` and a
+# machine with no twg installed simply has nothing at the far end — which the
+# dashboard's availability gate reports as absent. This also removes an old
+# footgun: Docker CREATES a missing bind source, so the previous file mount
+# made a root-owned DIRECTORY at ~/.local/bin/twg on a machine without twg,
+# which then blocked installing it there.
+services:
+  web:
+    volumes:
+      - "${HOME}/.local/bin:/host-local-bin:ro"
+      - "${HOME}/.config/twg:/home/${USER}/.config/twg:rw"

package/core/workspace-app/.ddev/docker-compose.plugin-upsun-upsun-cli.yaml

@@ -0,0 +1,8 @@
+# The upsun CLI session, shared FROM THE HOST like the twg one: one login, token
+# refreshes land on the host, rebuilds keep it. This is what turns the Upsun
+# branch-and-data commands from shown-to-copy into runnable dashboard actions.
+# A machine without a session mounts an empty dir and the actions say so.
+services:
+  web:
+    volumes:
+      - "${HOME}/.upsun-cli:/home/${USER}/.upsun-cli:rw"

package/core/workspace-app/.ddev/docker-compose.screens.yaml

@@ -0,0 +1,15 @@
+# Screen sessions live on the machine, not in here — so `screen -r` in a real
+# terminal reaches them and a browser an agent opens is a window on the desktop.
+# The dashboard still has to list and attach them, and the host is unreachable
+# over the network (ufw drops the docker bridges), so it goes through the
+# sockets screen itself uses. Same screen version, same user, same default
+# socket directory, so `screen -ls` and `screen -x` work straight across.
+services:
+  web:
+    # screen's attach hands a pty over the socket and then signals the session
+    # process — so the client has to be able to name that process. Sharing the
+    # machine's pid namespace is what makes `screen -x` work from in here; the
+    # app runs as the same user, so it can reach nothing that user could not.
+    pid: "host"
+    volumes:
+      - "/run/screen:/run/screen"

package/core/workspace-app/.ddev/nginx_full/nginx-site.conf

@@ -0,0 +1,114 @@
+# The Node/Express-style app runs inside THIS container (web_extra_daemon).
+# Three vhost tiers:
+#   1. <project>.<workspace>.workspace.ddev.site — cosmetic hierarchical
+#      alias for a project's own site: proxied straight to the ddev-router
+#      with the Host rewritten to <project>.ddev.site.
+#   2. <workspace>.workspace.ddev.site — that workspace's dashboard page
+#      (the Node app maps the host to the workspace).
+#   3. workspace.ddev.site — the dashboard home.
+
+# $connection_upgrade: "upgrade" while a request is upgrading, "close" otherwise. A
+# websocket proxy needs it; a plain `Connection upgrade` on every request breaks keepalive.
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    ''      close;
+}
+
+# Tier 0: the Web IDE — code-server (VS Code in the browser) on its OWN hostname.
+#
+# A hostname and not a subpath: code-server is a single-page app that builds absolute
+# URLs for its workers, its websocket and its static assets, and serving it under /ide/
+# means rewriting all of them. Upstream's own guidance is a dedicated (sub)domain, and it
+# costs nothing here — `*.workspace` is already in additional_hostnames, so DDEV's router
+# routes ide.workspace.ddev.site and its certificate already covers it.
+#
+# An EXACT server_name, so it wins over the regex block below (nginx prefers an exact
+# match to a regex however they are ordered) — otherwise these requests would go to the
+# Node dashboard, which knows nothing about them.
+server {
+    listen 80;
+    listen 443 ssl;
+    server_name ide.workspace.ddev.site;
+
+    ssl_certificate /etc/ssl/certs/master.crt;
+    ssl_certificate_key /etc/ssl/certs/master.key;
+
+    # An IDE moves whole directories and opens large files.
+    client_max_body_size 0;
+
+    location / {
+        proxy_pass http://127.0.0.1:8443;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        # The terminal, the extension host and the file watcher are all websockets.
+        # Without these the editor loads and then hangs with "reconnecting…".
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        # A build, a composer install or a long terminal command must not be cut off
+        # mid-stream by a proxy read timeout.
+        proxy_read_timeout 86400s;
+        proxy_send_timeout 86400s;
+        proxy_buffering off;
+    }
+}
+
+# Tier 1: project passthrough (two labels before workspace.)
+server {
+    listen 80;
+    listen 443 ssl;
+    server_name ~^(?<proj>[a-z0-9-]+)\.(?<ws>[a-z0-9_-]+)\.workspace\.ddev\.site$;
+
+    ssl_certificate /etc/ssl/certs/master.crt;
+    ssl_certificate_key /etc/ssl/certs/master.key;
+
+    # Resolve ddev-router at REQUEST time, not at startup: nginx resolves a
+    # literal upstream host when it loads the config and refuses to start if
+    # it cannot ("host not found in upstream"). On a cold Docker the router
+    # does not exist yet -- ddev only starts it after this container is
+    # healthy -- so a literal name deadlocks `ddev start`. A variable in
+    # proxy_pass defers the lookup to Docker's embedded DNS per request.
+    resolver 127.0.0.11 valid=10s ipv6=off;
+    set $ddev_router ddev-router;
+
+    location / {
+        # Resolve ddev-router at request time via Docker DNS — a literal
+        # upstream is resolved at config load and kills nginx on cold start,
+        # when ddev only launches the router after this container is healthy.
+        resolver 127.0.0.11 valid=10s;
+        set $ddev_router http://ddev-router:80;
+        proxy_pass $ddev_router;
+        proxy_http_version 1.1;
+        proxy_set_header Host $proj.ddev.site;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_redirect ~^https?://([a-z0-9-]+)\.ddev\.site(/.*)$ $scheme://$proj.$ws.workspace.ddev.site$2;
+    }
+}
+
+# Tiers 2+3: the dashboard app (Node maps <ws>.workspace hosts itself)
+server {
+    listen 80 default_server;
+    listen 443 ssl default_server;
+
+    server_name workspace.ddev.site ~^[a-z0-9_-]+\.workspace\.ddev\.site$;
+
+    ssl_certificate /etc/ssl/certs/master.crt;
+    ssl_certificate_key /etc/ssl/certs/master.key;
+
+    include /etc/nginx/monitoring.conf;
+
+    location / {
+        proxy_pass http://127.0.0.1:3000;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+}