update nginx

README.md

@@ -52,29 +52,6 @@ deployment to Let's Encrypt:
 ./manage.sh start
 ```
 
-## Nginx configuration
-
-At first `install.sh` or `manage.sh` run, the deployment copies its editable
-Nginx templates to `config/nginx/`. Those local files are never overwritten by
-an update:
-
-- `bootstrap.conf.template` serves the Let's Encrypt HTTP-01 challenge.
-- `http.conf.template` is used only in `SSL_MODE=none` test mode.
-- `tls.conf.template` is the active production HTTPS reverse-proxy template.
-- `sites/*.conf` is included by the HTTP and TLS templates for additional
-  virtual hosts.
-
-After editing a template or site snippet, recreate Nginx to render templates
-and apply the configuration:
-
-```sh
-./manage.sh reload-nginx
-```
-
-The command selects the active HTTP or TLS configuration and validates Nginx
-after recreating it. Keep certificates in `config/ssl` or `config/letsencrypt`;
-they remain read-only mounts separate from the editable Nginx configuration.
-
 ## Local checks
 
 ```sh

compose.http.yaml

@@ -11,4 +11,4 @@ services:
 
   nginx:
     volumes:
-      - ./config/nginx/http.conf.template:/etc/nginx/templates/default.conf.template:ro
+      - ./deploy/nginx/templates/http.conf.template:/etc/nginx/templates/default.conf.template:ro

compose.tls.yaml

@@ -3,7 +3,7 @@ services:
     ports:
       - "${HTTPS_PORT:-8643}:443"
     volumes:
-      - ./config/nginx/tls.conf.template:/etc/nginx/templates/default.conf.template:ro
+      - ./deploy/nginx/templates/tls.conf.template:/etc/nginx/templates/default.conf.template:ro
       - ${SSL_CERTIFICATE_DIR:-./config/ssl}:/etc/nginx/ssl:ro
       # Certbot's live certificates are symlinks into ../../archive.
       - ./config/letsencrypt/archive:/etc/archive:ro

compose.yaml

@@ -79,8 +79,7 @@ services:
     ports:
       - "${HTTP_PORT:-8680}:80"
     volumes:
-      - ./config/nginx/bootstrap.conf.template:/etc/nginx/templates/default.conf.template:ro
+      - ./deploy/nginx/templates/bootstrap.conf.template:/etc/nginx/templates/default.conf.template:ro
-      - ./config/nginx/sites:/etc/nginx/sites:ro
       - ./config/certbot-webroot:/var/www/certbot:ro
     environment:
       BROKER_DOMAIN: ${BROKER_DOMAIN}

config/.gitignore

@@ -15,9 +15,5 @@
 !ssl/.gitkeep
 !certbot-webroot/
 !certbot-webroot/.gitkeep
-!nginx/
-!nginx/.gitkeep
-!nginx/sites/
-!nginx/sites/.gitkeep
 !backups/
 !backups/.gitkeep

config/nginx/.gitkeep

@@ -1 +0,0 @@
-

config/nginx/sites/.gitkeep

@@ -1 +0,0 @@
-

deploy/nginx/templates/http.conf.template

@@ -57,9 +57,6 @@ server {
     }
 }
 
-# Local virtual-host snippets are mounted from config/nginx/sites.
-include /etc/nginx/sites/*.conf;
-
 server {
     listen 80;
     server_name ${GITEA_DOMAIN};

deploy/nginx/templates/tls.conf.template

@@ -43,9 +43,6 @@ server {
     }
 }
 
-# Local virtual-host snippets are mounted from config/nginx/sites.
-include /etc/nginx/sites/*.conf;
-
 server {
     listen 443 ssl default_server;
     server_name _;

install.sh

@@ -36,7 +36,6 @@ for required_file in \
 	compose.yaml \
 	compose.http.yaml \
 	compose.tls.yaml \
-	deploy/nginx/templates/bootstrap.conf.template \
 	deploy/nginx/templates/http.conf.template \
 	deploy/nginx/templates/tls.conf.template; do
 	[[ -f "$required_file" ]] ||

manage.sh

@@ -79,13 +79,12 @@ require_regular_file() {
 
 require_stack_files() {
 	require_regular_file compose.yaml
-	require_regular_file deploy/nginx/templates/bootstrap.conf.template
-	require_regular_file deploy/nginx/templates/http.conf.template
-	require_regular_file deploy/nginx/templates/tls.conf.template
 	if [[ "$SSL_MODE" == "none" ]]; then
 		require_regular_file compose.http.yaml
+		require_regular_file deploy/nginx/templates/http.conf.template
 	else
 		require_regular_file compose.tls.yaml
+		require_regular_file deploy/nginx/templates/tls.conf.template
 	fi
 }
 
@@ -198,7 +197,6 @@ prepare() {
 		config/gitea/config \
 		config/letsencrypt \
 		config/letsencrypt/archive \
-		config/nginx/sites \
 		config/ssl \
 		config/certbot-webroot \
 		config/backups
@@ -206,16 +204,6 @@ prepare() {
 	if [[ "$(id -u)" == 0 ]]; then
 		chown -R 1000:1000 config/broker config/gitea
 	fi
-	for template_name in bootstrap http tls; do
-		if [[ -e "config/nginx/${template_name}.conf.template" ]]; then
-			[[ -f "config/nginx/${template_name}.conf.template" ]] ||
-				fail "config/nginx/${template_name}.conf.template must be a regular file"
-		else
-			install -m 0644 \
-				"deploy/nginx/templates/${template_name}.conf.template" \
-				"config/nginx/${template_name}.conf.template"
-		fi
-	done
 	docker network inspect tapm-edge >/dev/null 2>&1 ||
 		docker network create tapm-edge >/dev/null
 }
@@ -392,13 +380,6 @@ renew)
 	docker compose --profile tools run --rm certbot renew --quiet
 	compose_stack exec nginx nginx -s reload
 	;;
-reload-nginx)
-	require_env
-	prepare
-	compose_stack up -d --force-recreate nginx
-	compose_stack exec nginx nginx -t
-	printf 'Nginx configuration was recreated and validated.\n'
-	;;
 backup)
 	require_env
 	prepare
@@ -439,7 +420,7 @@ broker-logs)
 	compose_stack logs --tail=100 broker
 	;;
 *)
-printf 'Usage: %s {prepare|bootstrap|configure-broker|rotate-cookie-secret|set-ssl|start|start-direct|create-admin|renew|reload-nginx|backup|status|diagnostics}\n' "$0"
+	printf 'Usage: %s {prepare|bootstrap|configure-broker|rotate-cookie-secret|set-ssl|start|start-direct|create-admin|renew|backup|status|diagnostics}\n' "$0"
 	exit 2
 	;;
 esac

tests/test-deployment-scripts.sh

@@ -82,16 +82,6 @@ for template in \
 		}
 	done
 done
-grep -F -- './config/nginx/bootstrap.conf.template:/etc/nginx/templates/default.conf.template:ro' \
-	"${TEST_ROOT}/compose.yaml" >/dev/null || {
-	printf 'FAIL: Nginx bootstrap template is not deployment-local\n' >&2
-	exit 1
-}
-grep -F -- './config/nginx/sites:/etc/nginx/sites:ro' \
-	"${TEST_ROOT}/compose.yaml" >/dev/null || {
-	printf 'FAIL: Nginx site snippets are not mounted from configuration\n' >&2
-	exit 1
-}
 
 printf '%s\n' \
 	'broker.test' \
@@ -115,21 +105,6 @@ assert_env 'TAPM_GITEA_URL=http://git.test:8780'
 assert_env 'TAPM_GITEA_INTERNAL_URL=http://gitea:3000'
 assert_env 'GITEA_PUBLIC_URL=http://git.test:8780/'
 assert_env 'TAPM_DEFAULT_DURATION=7d'
-for template_name in bootstrap http tls; do
-	cmp "${TEST_ROOT}/deploy/nginx/templates/${template_name}.conf.template" \
-		"${deployment}/config/nginx/${template_name}.conf.template" || {
-		printf 'FAIL: Nginx %s template was not seeded into config/nginx\n' "$template_name" >&2
-		exit 1
-	}
-done
-printf '%s\n' '# local Nginx customization' \
-	>"${deployment}/config/nginx/http.conf.template"
-"${deployment}/manage.sh" prepare >/dev/null
-grep -Fx '# local Nginx customization' \
-	"${deployment}/config/nginx/http.conf.template" >/dev/null || {
-	printf 'FAIL: Nginx configuration was overwritten during prepare\n' >&2
-	exit 1
-}
 grep -F -- '-f compose.yaml -f compose.http.yaml up -d gitea nginx' \
 	"$MOCK_DOCKER_LOG" >/dev/null || {
 	printf 'FAIL: HTTP bootstrap did not select compose.http.yaml\n' >&2
@@ -160,13 +135,6 @@ assert_env 'GITEA_PUBLIC_URL=https://git.test/'
 assert_env 'SSL_MODE=none'
 assert_env 'TAPM_PUBLIC_URL=http://broker.test:8780'
 
-"${deployment}/manage.sh" reload-nginx >/dev/null
-grep -F -- '-f compose.yaml -f compose.http.yaml up -d --force-recreate nginx' \
-	"$MOCK_DOCKER_LOG" >/dev/null || {
-	printf 'FAIL: Nginx reload did not use the active HTTP stack\n' >&2
-	exit 1
-}
-
 "${deployment}/manage.sh" rotate-cookie-secret >/dev/null
 rotated_secret="$(
 	sed -n 's/^TAPM_COOKIE_SECRET=//p' "${deployment}/.env"