Tonne of debugging - getting ready for the production builds

nginx/Dockerfile

@@ -1,8 +1,17 @@
 FROM nginx:alpine
 
+# Install envsubst for environment variable substitution
+RUN apk add --no-cache gettext
+
 RUN rm /etc/nginx/conf.d/default.conf
 
 COPY nginx.conf /etc/nginx/nginx.conf
-COPY conf.d/ /etc/nginx/conf.d/
+# Copy template files (will be processed by entrypoint.sh)
+COPY conf.d/*.template /etc/nginx/conf.d/
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
 
 EXPOSE 80 443
+
+ENTRYPOINT ["/entrypoint.sh"]
+CMD ["nginx", "-g", "daemon off;"]

nginx/conf.d/api.conf

@@ -1,8 +1,29 @@
 server {
     listen 80;
-    server_name api.cmlite.org;
+    server_name api.cmlite.org api.betteredmonton.org;
     add_header X-Frame-Options "SAMEORIGIN" always;
 
+    # Media API endpoints (must come BEFORE / for longest prefix match)
+    location /media/ {
+        set $upstream_media http://changemaker-media-api:4100/api/;
+        proxy_pass $upstream_media;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # Large upload support
+        client_max_body_size 10G;
+        proxy_read_timeout 3600s;
+        proxy_connect_timeout 75s;
+        proxy_request_buffering off;
+
+        # WebSocket support
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    # Main API (Express)
     location / {
         set $upstream_api http://changemaker-v2-api:4000;
         proxy_pass $upstream_api;

nginx/conf.d/api.conf.template

@@ -0,0 +1,38 @@
+server {
+    listen 80;
+    server_name api.${DOMAIN};
+    add_header X-Frame-Options "SAMEORIGIN" always;
+
+    # Media API endpoints (must come BEFORE / for longest prefix match)
+    # Rewrites /media/* to /api/* on media-api (port 4100)
+    location /media/ {
+        rewrite ^/media/(.*) /api/$1 break;
+        proxy_pass http://changemaker-media-api:4100;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # Large upload support
+        client_max_body_size 10G;
+        proxy_read_timeout 3600s;
+        proxy_connect_timeout 75s;
+        proxy_request_buffering off;
+
+        # WebSocket support
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    # Main API (Express)
+    location / {
+        set $upstream_api http://changemaker-v2-api:4000;
+        proxy_pass $upstream_api;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 300s;
+        proxy_connect_timeout 75s;
+    }
+}

nginx/conf.d/default.conf

@@ -17,7 +17,51 @@ server {
         proxy_set_header Connection "upgrade";
     }
 
-    # API
+    # Media API admin routes (must come BEFORE /api/ for longest prefix match)
+    # Rewrites /api/media/* to /api/* on media-api
+    location /api/media/ {
+        rewrite ^/api/media/(.*) /api/$1 break;
+        proxy_pass http://changemaker-media-api:4100;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # Large upload support
+        client_max_body_size 10G;
+        proxy_read_timeout 3600s;
+        proxy_connect_timeout 75s;
+        proxy_request_buffering off;
+
+        # WebSocket support for future features
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    # Media API routes rewrite (matches Vite dev proxy behavior)
+    # Rewrites /media/* to /api/* on media-api (port 4100)
+    # Uses variable proxy_pass for runtime DNS resolution after container restarts
+    location /media/ {
+        rewrite ^/media/(.*) /api/$1 break;
+        set $upstream_media_default http://changemaker-media-api:4100;
+        proxy_pass $upstream_media_default;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # Large upload support
+        client_max_body_size 10G;
+        proxy_read_timeout 3600s;
+        proxy_connect_timeout 75s;
+        proxy_request_buffering off;
+
+        # WebSocket support
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    # API (Express)
     location /api/ {
         set $upstream_api http://changemaker-v2-api:4000;
         proxy_pass $upstream_api;

nginx/conf.d/default.conf.template

@@ -0,0 +1,70 @@
+# Default server — local development fallback
+# Routes by path when not using subdomain-based routing
+server {
+    listen 80 default_server;
+    server_name localhost _;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+
+    # Admin GUI (default)
+    location / {
+        set $upstream_admin http://changemaker-v2-admin:3000;
+        proxy_pass $upstream_admin;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    # Media API routes rewrite (matches Vite dev proxy behavior)
+    # Rewrites /media/* to /api/* on media-api (port 4100)
+    location /media/ {
+        rewrite ^/media/(.*) /api/$1 break;
+        proxy_pass http://changemaker-media-api:4100;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # Large upload support
+        client_max_body_size 10G;
+        proxy_read_timeout 3600s;
+        proxy_connect_timeout 75s;
+        proxy_request_buffering off;
+
+        # WebSocket support
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    # Media API (must come BEFORE /api/ for longest prefix match)
+    location /api/media/ {
+        set $upstream_media http://changemaker-media-api:4100;
+        proxy_pass $upstream_media;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # Large upload support
+        client_max_body_size 10G;
+        proxy_read_timeout 3600s;
+        proxy_connect_timeout 75s;
+        proxy_request_buffering off;
+
+        # WebSocket support for future features
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    # API (Express)
+    location /api/ {
+        set $upstream_api http://changemaker-v2-api:4000;
+        proxy_pass $upstream_api;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}

nginx/conf.d/services.conf

@@ -40,7 +40,7 @@ server {
 # Grafana
 server {
     listen 80;
-    server_name grafana.cmlite.org;
+    server_name grafana.cmlite.org grafana.betteredmonton.org;
     add_header X-Frame-Options "SAMEORIGIN" always;
 
     location / {
@@ -55,11 +55,11 @@ server {
     }
 }
 
-# NocoDB (data browser) — allows iframe embedding from admin (app.cmlite.org)
+# NocoDB (data browser) — allows iframe embedding from admin
 server {
     listen 80;
-    server_name db.cmlite.org;
-    add_header Content-Security-Policy "frame-ancestors 'self' app.cmlite.org" always;
+    server_name db.cmlite.org db.betteredmonton.org;
+    add_header Content-Security-Policy "frame-ancestors 'self' app.cmlite.org app.betteredmonton.org" always;
 
     location / {
         set $upstream_nocodb http://changemaker-v2-nocodb:8080;
@@ -75,7 +75,7 @@ server {
 # Listmonk
 server {
     listen 80;
-    server_name listmonk.cmlite.org;
+    server_name listmonk.cmlite.org listmonk.betteredmonton.org;
     add_header X-Frame-Options "SAMEORIGIN" always;
 
     location / {
@@ -88,11 +88,11 @@ server {
     }
 }
 
-# MkDocs — allows iframe embedding from admin (app.cmlite.org)
+# MkDocs — allows iframe embedding from admin
 server {
     listen 80;
-    server_name docs.cmlite.org;
-    add_header Content-Security-Policy "frame-ancestors 'self' app.cmlite.org" always;
+    server_name docs.cmlite.org docs.betteredmonton.org;
+    add_header Content-Security-Policy "frame-ancestors 'self' app.cmlite.org app.betteredmonton.org" always;
 
     location / {
         set $upstream_mkdocs http://mkdocs-changemaker:8000;
@@ -144,6 +144,45 @@ server {
     }
 }
 
+# Mini QR — allows iframe embedding from admin (app.cmlite.org)
+server {
+    listen 80;
+    server_name qr.cmlite.org;
+    add_header Content-Security-Policy "frame-ancestors 'self' app.cmlite.org" always;
+
+    location / {
+        set $upstream_miniqr http://mini-qr:8080;
+        proxy_pass $upstream_miniqr;
+        proxy_hide_header X-Frame-Options;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+# Excalidraw — allows iframe embedding from admin (app.cmlite.org)
+server {
+    listen 80;
+    server_name draw.cmlite.org;
+    add_header Content-Security-Policy "frame-ancestors 'self' app.cmlite.org" always;
+
+    location / {
+        set $upstream_excalidraw http://excalidraw-changemaker:80;
+        proxy_pass $upstream_excalidraw;
+        proxy_hide_header X-Frame-Options;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # WebSocket support for collaboration
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_http_version 1.1;
+    }
+}
+
 # --- Embed proxy ports (for iframe embedding without DNS/subdomain) ---
 # These listen on dedicated ports so the admin GUI can iframe services via
 # localhost:PORT, bypassing X-Frame-Options without needing *.localhost DNS.
@@ -210,6 +249,112 @@ server {
     }
 }
 
+server {
+    listen 8885;
+    location / {
+        set $upstream_miniqr http://mini-qr:8080;
+        proxy_pass $upstream_miniqr;
+        proxy_hide_header X-Frame-Options;
+        proxy_hide_header Content-Security-Policy;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+# Excalidraw embed proxy (port 8886)
+server {
+    listen 8886;
+    location / {
+        set $upstream_excalidraw http://excalidraw-changemaker:80;
+        proxy_pass $upstream_excalidraw;
+        proxy_hide_header X-Frame-Options;
+        proxy_hide_header Content-Security-Policy;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # WebSocket support for collaboration
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_http_version 1.1;
+    }
+}
+
+# Admin GUI — app subdomain
+server {
+    listen 80;
+    server_name app.cmlite.org app.betteredmonton.org;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+
+    location / {
+        set $upstream_admin http://changemaker-v2-admin:3000;
+        proxy_pass $upstream_admin;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        # WebSocket support for Vite HMR
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    # Media API (direct path - used by admin GUI media-api.ts client)
+    # Rewrites /media/* to /api/* (matches Vite dev proxy behavior)
+    # Uses variable proxy_pass for runtime DNS resolution after container restarts
+    location /media/ {
+        rewrite ^/media/(.*) /api/$1 break;
+        set $upstream_media_app http://changemaker-media-api:4100;
+        proxy_pass $upstream_media_app;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # Large file upload support
+        client_max_body_size 10G;
+        proxy_read_timeout 3600s;
+        proxy_connect_timeout 75s;
+        proxy_request_buffering off;
+
+        # WebSocket support
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    # Media API endpoints (must come BEFORE /api/ for longest prefix match)
+    location /api/media/ {
+        set $upstream_media http://changemaker-media-api:4100;
+        proxy_pass $upstream_media;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # Large upload support
+        client_max_body_size 10G;
+        proxy_read_timeout 3600s;
+        proxy_connect_timeout 75s;
+        proxy_request_buffering off;
+
+        # WebSocket support
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    # API (Express)
+    location /api/ {
+        set $upstream_api http://changemaker-v2-api:4000;
+        proxy_pass $upstream_api;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
 # MkDocs built static site — root domain
 server {
     listen 80;
@@ -225,6 +370,77 @@ server {
     }
 }
 
+# Root domain — routes to admin GUI (supports custom DOMAIN env var)
+server {
+    listen 80;
+    server_name betteredmonton.org;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+
+    location / {
+        set $upstream_admin http://changemaker-v2-admin:3000;
+        proxy_pass $upstream_admin;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        # WebSocket support for Vite HMR
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    # Media API (direct path - used by admin GUI media-api.ts client)
+    # Uses variable proxy_pass for runtime DNS resolution after container restarts
+    location /media/ {
+        rewrite ^/media/(.*) /api/$1 break;
+        set $upstream_media_root http://changemaker-media-api:4100;
+        proxy_pass $upstream_media_root;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # Large file upload support
+        client_max_body_size 10G;
+        proxy_read_timeout 3600s;
+        proxy_connect_timeout 75s;
+        proxy_request_buffering off;
+
+        # WebSocket support
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    # Media API endpoints (must come BEFORE /api/ for longest prefix match)
+    location /api/media/ {
+        set $upstream_media http://changemaker-media-api:4100;
+        proxy_pass $upstream_media;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # Large upload support
+        client_max_body_size 10G;
+        proxy_read_timeout 3600s;
+        proxy_connect_timeout 75s;
+        proxy_request_buffering off;
+
+        # WebSocket support
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    # API (Express)
+    location /api/ {
+        set $upstream_api http://changemaker-v2-api:4000;
+        proxy_pass $upstream_api;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
 # Homepage dashboard
 server {
     listen 80;

nginx/conf.d/services.conf.template

@@ -0,0 +1,385 @@
+# Gitea — allows iframe embedding from admin (app.${DOMAIN})
+server {
+    listen 80;
+    server_name git.${DOMAIN};
+    add_header Content-Security-Policy "frame-ancestors 'self' app.${DOMAIN}" always;
+
+    # Increase max body size for large git pushes (2GB)
+    client_max_body_size 2048M;
+
+    location / {
+        set $upstream_gitea http://gitea-changemaker:3000;
+        proxy_pass $upstream_gitea;
+        proxy_hide_header X-Frame-Options;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+# n8n — allows iframe embedding from admin (app.${DOMAIN})
+server {
+    listen 80;
+    server_name n8n.${DOMAIN};
+    add_header Content-Security-Policy "frame-ancestors 'self' app.${DOMAIN}" always;
+
+    location / {
+        set $upstream_n8n http://n8n-changemaker:5678;
+        proxy_pass $upstream_n8n;
+        proxy_hide_header X-Frame-Options;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+}
+
+# Grafana
+server {
+    listen 80;
+    server_name grafana.${DOMAIN};
+    add_header X-Frame-Options "SAMEORIGIN" always;
+
+    location / {
+        set $upstream_grafana http://grafana-changemaker:3000;
+        proxy_pass $upstream_grafana;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+}
+
+# NocoDB (data browser) — allows iframe embedding from admin
+server {
+    listen 80;
+    server_name db.${DOMAIN};
+    add_header Content-Security-Policy "frame-ancestors 'self' app.${DOMAIN}" always;
+
+    location / {
+        set $upstream_nocodb http://changemaker-v2-nocodb:8080;
+        proxy_pass $upstream_nocodb;
+        proxy_hide_header X-Frame-Options;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+# Listmonk
+server {
+    listen 80;
+    server_name listmonk.${DOMAIN};
+    add_header X-Frame-Options "SAMEORIGIN" always;
+
+    location / {
+        set $upstream_listmonk http://listmonk-app:9000;
+        proxy_pass $upstream_listmonk;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+# MkDocs — allows iframe embedding from admin
+server {
+    listen 80;
+    server_name docs.${DOMAIN};
+    add_header Content-Security-Policy "frame-ancestors 'self' app.${DOMAIN}" always;
+
+    location / {
+        set $upstream_mkdocs http://mkdocs-changemaker:8000;
+        proxy_pass $upstream_mkdocs;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+}
+
+# Code Server — allows iframe embedding from admin (app.${DOMAIN})
+server {
+    listen 80;
+    server_name code.${DOMAIN};
+    add_header Content-Security-Policy "frame-ancestors 'self' app.${DOMAIN}" always;
+
+    location / {
+        set $upstream_code http://code-server-changemaker:8080;
+        proxy_pass $upstream_code;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+}
+
+# MailHog (email testing) — allows iframe embedding from admin (app.${DOMAIN})
+server {
+    listen 80;
+    server_name mail.${DOMAIN};
+    add_header Content-Security-Policy "frame-ancestors 'self' app.${DOMAIN}" always;
+
+    location / {
+        set $upstream_mailhog http://mailhog-changemaker:8025;
+        proxy_pass $upstream_mailhog;
+        proxy_hide_header X-Frame-Options;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        # WebSocket support for MailHog live updates
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+}
+
+# Mini QR — allows iframe embedding from admin (app.${DOMAIN})
+server {
+    listen 80;
+    server_name qr.${DOMAIN};
+    add_header Content-Security-Policy "frame-ancestors 'self' app.${DOMAIN}" always;
+
+    location / {
+        set $upstream_miniqr http://mini-qr:8080;
+        proxy_pass $upstream_miniqr;
+        proxy_hide_header X-Frame-Options;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+# Excalidraw — allows iframe embedding from admin (app.${DOMAIN})
+server {
+    listen 80;
+    server_name draw.${DOMAIN};
+    add_header Content-Security-Policy "frame-ancestors 'self' app.${DOMAIN}" always;
+
+    location / {
+        set $upstream_excalidraw http://excalidraw-changemaker:80;
+        proxy_pass $upstream_excalidraw;
+        proxy_hide_header X-Frame-Options;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # WebSocket support for collaboration
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_http_version 1.1;
+    }
+}
+
+# --- Embed proxy ports (for iframe embedding without DNS/subdomain) ---
+# These listen on dedicated ports so the admin GUI can iframe services via
+# localhost:PORT, bypassing X-Frame-Options without needing *.localhost DNS.
+
+server {
+    listen 8881;
+    location / {
+        set $upstream_nocodb http://changemaker-v2-nocodb:8080;
+        proxy_pass $upstream_nocodb;
+        proxy_hide_header X-Frame-Options;
+        proxy_hide_header Content-Security-Policy;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+server {
+    listen 8882;
+    location / {
+        set $upstream_n8n http://n8n-changemaker:5678;
+        proxy_pass $upstream_n8n;
+        proxy_hide_header X-Frame-Options;
+        proxy_hide_header Content-Security-Policy;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+}
+
+server {
+    listen 8883;
+    # Increase max body size for large git pushes (2GB)
+    client_max_body_size 2048M;
+    location / {
+        set $upstream_gitea http://gitea-changemaker:3000;
+        proxy_pass $upstream_gitea;
+        proxy_hide_header X-Frame-Options;
+        proxy_hide_header Content-Security-Policy;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+server {
+    listen 8884;
+    location / {
+        set $upstream_mailhog http://mailhog-changemaker:8025;
+        proxy_pass $upstream_mailhog;
+        proxy_hide_header X-Frame-Options;
+        proxy_hide_header Content-Security-Policy;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+}
+
+server {
+    listen 8885;
+    location / {
+        set $upstream_miniqr http://mini-qr:8080;
+        proxy_pass $upstream_miniqr;
+        proxy_hide_header X-Frame-Options;
+        proxy_hide_header Content-Security-Policy;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+# Excalidraw embed proxy (port 8886)
+server {
+    listen 8886;
+    location / {
+        set $upstream_excalidraw http://excalidraw-changemaker:80;
+        proxy_pass $upstream_excalidraw;
+        proxy_hide_header X-Frame-Options;
+        proxy_hide_header Content-Security-Policy;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # WebSocket support for collaboration
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_http_version 1.1;
+    }
+}
+
+# Admin GUI — app subdomain
+server {
+    listen 80;
+    server_name app.${DOMAIN};
+    add_header X-Frame-Options "SAMEORIGIN" always;
+
+    location / {
+        set $upstream_admin http://changemaker-v2-admin:3000;
+        proxy_pass $upstream_admin;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        # WebSocket support for Vite HMR
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    # Media API routes rewrite (matches Vite dev proxy behavior)
+    # Rewrites /media/* to /api/* on media-api (port 4100)
+    location /media/ {
+        rewrite ^/media/(.*) /api/$1 break;
+        proxy_pass http://changemaker-media-api:4100;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # Large file upload support
+        client_max_body_size 10G;
+        proxy_read_timeout 3600s;
+        proxy_connect_timeout 75s;
+        proxy_request_buffering off;
+
+        # WebSocket support
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    # Media API endpoints (must come BEFORE /api/ for longest prefix match)
+    location /api/media/ {
+        set $upstream_media http://changemaker-media-api:4100;
+        proxy_pass $upstream_media;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # Large upload support
+        client_max_body_size 10G;
+        proxy_read_timeout 3600s;
+        proxy_connect_timeout 75s;
+        proxy_request_buffering off;
+
+        # WebSocket support
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    # API (Express)
+    location /api/ {
+        set $upstream_api http://changemaker-v2-api:4000;
+        proxy_pass $upstream_api;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+# Root domain — routes to MkDocs static site only
+server {
+    listen 80;
+    server_name ${DOMAIN};
+
+    location / {
+        set $upstream_site http://mkdocs-site-server-changemaker:80;
+        proxy_pass $upstream_site;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+# Homepage dashboard
+server {
+    listen 80;
+    server_name home.${DOMAIN};
+    add_header X-Frame-Options "SAMEORIGIN" always;
+
+    location / {
+        set $upstream_homepage http://homepage-changemaker:3000;
+        proxy_pass $upstream_homepage;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}

nginx/conf.d/services.conf.template.bak

@@ -0,0 +1,413 @@
+# Gitea — allows iframe embedding from admin (app.cmlite.org)
+server {
+    listen 80;
+    server_name git.cmlite.org;
+    add_header Content-Security-Policy "frame-ancestors 'self' app.cmlite.org" always;
+
+    # Increase max body size for large git pushes (2GB)
+    client_max_body_size 2048M;
+
+    location / {
+        set $upstream_gitea http://gitea-changemaker:3000;
+        proxy_pass $upstream_gitea;
+        proxy_hide_header X-Frame-Options;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+# n8n — allows iframe embedding from admin (app.cmlite.org)
+server {
+    listen 80;
+    server_name n8n.cmlite.org;
+    add_header Content-Security-Policy "frame-ancestors 'self' app.cmlite.org" always;
+
+    location / {
+        set $upstream_n8n http://n8n-changemaker:5678;
+        proxy_pass $upstream_n8n;
+        proxy_hide_header X-Frame-Options;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+}
+
+# Grafana
+server {
+    listen 80;
+    server_name grafana.cmlite.org grafana.betteredmonton.org;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+
+    location / {
+        set $upstream_grafana http://grafana-changemaker:3000;
+        proxy_pass $upstream_grafana;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+}
+
+# NocoDB (data browser) — allows iframe embedding from admin
+server {
+    listen 80;
+    server_name db.cmlite.org db.betteredmonton.org;
+    add_header Content-Security-Policy "frame-ancestors 'self' app.cmlite.org app.betteredmonton.org" always;
+
+    location / {
+        set $upstream_nocodb http://changemaker-v2-nocodb:8080;
+        proxy_pass $upstream_nocodb;
+        proxy_hide_header X-Frame-Options;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+# Listmonk
+server {
+    listen 80;
+    server_name listmonk.cmlite.org listmonk.betteredmonton.org;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+
+    location / {
+        set $upstream_listmonk http://listmonk-app:9000;
+        proxy_pass $upstream_listmonk;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+# MkDocs — allows iframe embedding from admin
+server {
+    listen 80;
+    server_name docs.cmlite.org docs.betteredmonton.org;
+    add_header Content-Security-Policy "frame-ancestors 'self' app.cmlite.org app.betteredmonton.org" always;
+
+    location / {
+        set $upstream_mkdocs http://mkdocs-changemaker:8000;
+        proxy_pass $upstream_mkdocs;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+}
+
+# Code Server — allows iframe embedding from admin (app.cmlite.org)
+server {
+    listen 80;
+    server_name code.cmlite.org;
+    add_header Content-Security-Policy "frame-ancestors 'self' app.cmlite.org" always;
+
+    location / {
+        set $upstream_code http://code-server-changemaker:8080;
+        proxy_pass $upstream_code;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+}
+
+# MailHog (email testing) — allows iframe embedding from admin (app.cmlite.org)
+server {
+    listen 80;
+    server_name mail.cmlite.org;
+    add_header Content-Security-Policy "frame-ancestors 'self' app.cmlite.org" always;
+
+    location / {
+        set $upstream_mailhog http://mailhog-changemaker:8025;
+        proxy_pass $upstream_mailhog;
+        proxy_hide_header X-Frame-Options;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        # WebSocket support for MailHog live updates
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+}
+
+# Mini QR — allows iframe embedding from admin (app.cmlite.org)
+server {
+    listen 80;
+    server_name qr.cmlite.org;
+    add_header Content-Security-Policy "frame-ancestors 'self' app.cmlite.org" always;
+
+    location / {
+        set $upstream_miniqr http://mini-qr:8080;
+        proxy_pass $upstream_miniqr;
+        proxy_hide_header X-Frame-Options;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+# Excalidraw — allows iframe embedding from admin (app.cmlite.org)
+server {
+    listen 80;
+    server_name draw.cmlite.org;
+    add_header Content-Security-Policy "frame-ancestors 'self' app.cmlite.org" always;
+
+    location / {
+        set $upstream_excalidraw http://excalidraw-changemaker:80;
+        proxy_pass $upstream_excalidraw;
+        proxy_hide_header X-Frame-Options;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # WebSocket support for collaboration
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_http_version 1.1;
+    }
+}
+
+# --- Embed proxy ports (for iframe embedding without DNS/subdomain) ---
+# These listen on dedicated ports so the admin GUI can iframe services via
+# localhost:PORT, bypassing X-Frame-Options without needing *.localhost DNS.
+
+server {
+    listen 8881;
+    location / {
+        set $upstream_nocodb http://changemaker-v2-nocodb:8080;
+        proxy_pass $upstream_nocodb;
+        proxy_hide_header X-Frame-Options;
+        proxy_hide_header Content-Security-Policy;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+server {
+    listen 8882;
+    location / {
+        set $upstream_n8n http://n8n-changemaker:5678;
+        proxy_pass $upstream_n8n;
+        proxy_hide_header X-Frame-Options;
+        proxy_hide_header Content-Security-Policy;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+}
+
+server {
+    listen 8883;
+    # Increase max body size for large git pushes (2GB)
+    client_max_body_size 2048M;
+    location / {
+        set $upstream_gitea http://gitea-changemaker:3000;
+        proxy_pass $upstream_gitea;
+        proxy_hide_header X-Frame-Options;
+        proxy_hide_header Content-Security-Policy;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+server {
+    listen 8884;
+    location / {
+        set $upstream_mailhog http://mailhog-changemaker:8025;
+        proxy_pass $upstream_mailhog;
+        proxy_hide_header X-Frame-Options;
+        proxy_hide_header Content-Security-Policy;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+}
+
+server {
+    listen 8885;
+    location / {
+        set $upstream_miniqr http://mini-qr:8080;
+        proxy_pass $upstream_miniqr;
+        proxy_hide_header X-Frame-Options;
+        proxy_hide_header Content-Security-Policy;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+# Excalidraw embed proxy (port 8886)
+server {
+    listen 8886;
+    location / {
+        set $upstream_excalidraw http://excalidraw-changemaker:80;
+        proxy_pass $upstream_excalidraw;
+        proxy_hide_header X-Frame-Options;
+        proxy_hide_header Content-Security-Policy;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # WebSocket support for collaboration
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_http_version 1.1;
+    }
+}
+
+# Admin GUI — app subdomain
+server {
+    listen 80;
+    server_name app.cmlite.org app.betteredmonton.org;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+
+    location / {
+        set $upstream_admin http://changemaker-v2-admin:3000;
+        proxy_pass $upstream_admin;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        # WebSocket support for Vite HMR
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    # Media API endpoints (must come BEFORE /api/ for longest prefix match)
+    location /api/media/ {
+        set $upstream_media http://changemaker-media-api:4100;
+        proxy_pass $upstream_media;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # Large upload support
+        client_max_body_size 10G;
+        proxy_read_timeout 3600s;
+        proxy_connect_timeout 75s;
+        proxy_request_buffering off;
+
+        # WebSocket support
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    # API (Express)
+    location /api/ {
+        set $upstream_api http://changemaker-v2-api:4000;
+        proxy_pass $upstream_api;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+# MkDocs built static site — root domain
+server {
+    listen 80;
+    server_name cmlite.org;
+
+    location / {
+        set $upstream_site http://mkdocs-site-server-changemaker:80;
+        proxy_pass $upstream_site;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+# Root domain — routes to admin GUI (supports custom DOMAIN env var)
+server {
+    listen 80;
+    server_name betteredmonton.org;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+
+    location / {
+        set $upstream_admin http://changemaker-v2-admin:3000;
+        proxy_pass $upstream_admin;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        # WebSocket support for Vite HMR
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    # Media API endpoints (must come BEFORE /api/ for longest prefix match)
+    location /api/media/ {
+        set $upstream_media http://changemaker-media-api:4100;
+        proxy_pass $upstream_media;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # Large upload support
+        client_max_body_size 10G;
+        proxy_read_timeout 3600s;
+        proxy_connect_timeout 75s;
+        proxy_request_buffering off;
+
+        # WebSocket support
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    # API (Express)
+    location /api/ {
+        set $upstream_api http://changemaker-v2-api:4000;
+        proxy_pass $upstream_api;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+# Homepage dashboard
+server {
+    listen 80;
+    server_name home.cmlite.org;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+
+    location / {
+        set $upstream_homepage http://homepage-changemaker:3000;
+        proxy_pass $upstream_homepage;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}

nginx/entrypoint.sh

@@ -0,0 +1,20 @@
+#!/bin/sh
+set -e
+
+# Default domain if not set
+export DOMAIN=${DOMAIN:-cmlite.org}
+
+echo "Configuring nginx for domain: $DOMAIN"
+
+# Template nginx configuration files with environment variables
+envsubst '${DOMAIN}' < /etc/nginx/conf.d/default.conf.template > /etc/nginx/conf.d/default.conf
+envsubst '${DOMAIN}' < /etc/nginx/conf.d/api.conf.template > /etc/nginx/conf.d/api.conf
+envsubst '${DOMAIN}' < /etc/nginx/conf.d/services.conf.template > /etc/nginx/conf.d/services.conf
+
+echo "Nginx configuration templated successfully"
+
+# Test configuration
+nginx -t
+
+# Execute the original nginx entrypoint
+exec /docker-entrypoint.sh "$@"

nginx/nginx.conf

@@ -34,6 +34,8 @@ http {
     add_header X-Content-Type-Options "nosniff" always;
     add_header X-XSS-Protection "1; mode=block" always;
     add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    add_header Permissions-Policy "geolocation=(self), microphone=(), camera=()" always;
 
     # Docker internal DNS — enables runtime resolution so nginx starts
     # even when optional services are not running