Initial v2 commit: complete rebuild with unified API + React admin

Phase 1-14 complete:
- Unified Express.js API (TypeScript, Prisma ORM, PostgreSQL 16)
- React Admin GUI (Vite + Ant Design + Zustand)
- JWT auth with refresh tokens
- Influence: Campaigns, Representatives, Responses, Email Queue
- Map: Locations, Cuts, Shifts, Canvassing System
- NAR data import infrastructure (2025 format)
- Listmonk newsletter integration
- Landing page builder (GrapesJS)
- MkDocs + Code Server integration
- Volunteer portal with GPS tracking
- Monitoring stack (Prometheus, Grafana, Alertmanager)
- Pangolin tunnel integration

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

nginx/Dockerfile

@@ -0,0 +1,8 @@
+FROM nginx:alpine
+
+RUN rm /etc/nginx/conf.d/default.conf
+
+COPY nginx.conf /etc/nginx/nginx.conf
+COPY conf.d/ /etc/nginx/conf.d/
+
+EXPOSE 80 443

nginx/conf.d/admin.conf

@@ -0,0 +1,26 @@
+server {
+    listen 80;
+    server_name admin.cmlite.org;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+
+    location / {
+        set $upstream_admin http://changemaker-v2-admin:3000;
+        proxy_pass $upstream_admin;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    # API proxy for admin SPA
+    location /api/ {
+        set $upstream_api http://changemaker-v2-api:4000;
+        proxy_pass $upstream_api;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}

nginx/conf.d/api.conf

@@ -0,0 +1,16 @@
+server {
+    listen 80;
+    server_name api.cmlite.org;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+
+    location / {
+        set $upstream_api http://changemaker-v2-api:4000;
+        proxy_pass $upstream_api;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 300s;
+        proxy_connect_timeout 75s;
+    }
+}

nginx/conf.d/default.conf

@@ -0,0 +1,29 @@
+# Default server — local development fallback
+# Routes by path when not using subdomain-based routing
+server {
+    listen 80 default_server;
+    server_name localhost _;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+
+    # Admin GUI (default)
+    location / {
+        set $upstream_admin http://changemaker-v2-admin:3000;
+        proxy_pass $upstream_admin;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    # API
+    location /api/ {
+        set $upstream_api http://changemaker-v2-api:4000;
+        proxy_pass $upstream_api;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}

nginx/conf.d/public.conf

@@ -0,0 +1,43 @@
+server {
+    listen 80;
+    server_name map.cmlite.org;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+
+    root /usr/share/nginx/public-web/map;
+    index index.html;
+
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+
+    location /api/ {
+        set $upstream_api http://changemaker-v2-api:4000;
+        proxy_pass $upstream_api;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+server {
+    listen 80;
+    server_name influence.cmlite.org;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+
+    root /usr/share/nginx/public-web/influence;
+    index index.html;
+
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+
+    location /api/ {
+        set $upstream_api http://changemaker-v2-api:4000;
+        proxy_pass $upstream_api;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}

nginx/conf.d/services.conf

@@ -0,0 +1,242 @@
+# Gitea — allows iframe embedding from admin (app.cmlite.org)
+server {
+    listen 80;
+    server_name git.cmlite.org;
+    add_header Content-Security-Policy "frame-ancestors 'self' app.cmlite.org" always;
+
+    # Increase max body size for large git pushes (2GB)
+    client_max_body_size 2048M;
+
+    location / {
+        set $upstream_gitea http://gitea-changemaker:3000;
+        proxy_pass $upstream_gitea;
+        proxy_hide_header X-Frame-Options;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+# n8n — allows iframe embedding from admin (app.cmlite.org)
+server {
+    listen 80;
+    server_name n8n.cmlite.org;
+    add_header Content-Security-Policy "frame-ancestors 'self' app.cmlite.org" always;
+
+    location / {
+        set $upstream_n8n http://n8n-changemaker:5678;
+        proxy_pass $upstream_n8n;
+        proxy_hide_header X-Frame-Options;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+}
+
+# Grafana
+server {
+    listen 80;
+    server_name grafana.cmlite.org;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+
+    location / {
+        set $upstream_grafana http://grafana-changemaker:3000;
+        proxy_pass $upstream_grafana;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+}
+
+# NocoDB (data browser) — allows iframe embedding from admin (app.cmlite.org)
+server {
+    listen 80;
+    server_name db.cmlite.org;
+    add_header Content-Security-Policy "frame-ancestors 'self' app.cmlite.org" always;
+
+    location / {
+        set $upstream_nocodb http://changemaker-v2-nocodb:8080;
+        proxy_pass $upstream_nocodb;
+        proxy_hide_header X-Frame-Options;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+# Listmonk
+server {
+    listen 80;
+    server_name listmonk.cmlite.org;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+
+    location / {
+        set $upstream_listmonk http://listmonk-app:9000;
+        proxy_pass $upstream_listmonk;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+# MkDocs — allows iframe embedding from admin (app.cmlite.org)
+server {
+    listen 80;
+    server_name docs.cmlite.org;
+    add_header Content-Security-Policy "frame-ancestors 'self' app.cmlite.org" always;
+
+    location / {
+        set $upstream_mkdocs http://mkdocs-changemaker:8000;
+        proxy_pass $upstream_mkdocs;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+}
+
+# Code Server — allows iframe embedding from admin (app.cmlite.org)
+server {
+    listen 80;
+    server_name code.cmlite.org;
+    add_header Content-Security-Policy "frame-ancestors 'self' app.cmlite.org" always;
+
+    location / {
+        set $upstream_code http://code-server-changemaker:8080;
+        proxy_pass $upstream_code;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+}
+
+# MailHog (email testing) — allows iframe embedding from admin (app.cmlite.org)
+server {
+    listen 80;
+    server_name mail.cmlite.org;
+    add_header Content-Security-Policy "frame-ancestors 'self' app.cmlite.org" always;
+
+    location / {
+        set $upstream_mailhog http://mailhog-changemaker:8025;
+        proxy_pass $upstream_mailhog;
+        proxy_hide_header X-Frame-Options;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        # WebSocket support for MailHog live updates
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+}
+
+# --- Embed proxy ports (for iframe embedding without DNS/subdomain) ---
+# These listen on dedicated ports so the admin GUI can iframe services via
+# localhost:PORT, bypassing X-Frame-Options without needing *.localhost DNS.
+
+server {
+    listen 8881;
+    location / {
+        set $upstream_nocodb http://changemaker-v2-nocodb:8080;
+        proxy_pass $upstream_nocodb;
+        proxy_hide_header X-Frame-Options;
+        proxy_hide_header Content-Security-Policy;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+server {
+    listen 8882;
+    location / {
+        set $upstream_n8n http://n8n-changemaker:5678;
+        proxy_pass $upstream_n8n;
+        proxy_hide_header X-Frame-Options;
+        proxy_hide_header Content-Security-Policy;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+}
+
+server {
+    listen 8883;
+    # Increase max body size for large git pushes (2GB)
+    client_max_body_size 2048M;
+    location / {
+        set $upstream_gitea http://gitea-changemaker:3000;
+        proxy_pass $upstream_gitea;
+        proxy_hide_header X-Frame-Options;
+        proxy_hide_header Content-Security-Policy;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+server {
+    listen 8884;
+    location / {
+        set $upstream_mailhog http://mailhog-changemaker:8025;
+        proxy_pass $upstream_mailhog;
+        proxy_hide_header X-Frame-Options;
+        proxy_hide_header Content-Security-Policy;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+}
+
+# MkDocs built static site — root domain
+server {
+    listen 80;
+    server_name cmlite.org;
+
+    location / {
+        set $upstream_site http://mkdocs-site-server-changemaker:80;
+        proxy_pass $upstream_site;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+# Homepage dashboard
+server {
+    listen 80;
+    server_name home.cmlite.org;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+
+    location / {
+        set $upstream_homepage http://homepage-changemaker:3000;
+        proxy_pass $upstream_homepage;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}

nginx/nginx.conf

@@ -0,0 +1,43 @@
+worker_processes auto;
+error_log /var/log/nginx/error.log warn;
+pid /var/run/nginx.pid;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+
+    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
+                    '$status $body_bytes_sent "$http_referer" '
+                    '"$http_user_agent" "$http_x_forwarded_for"';
+
+    access_log /var/log/nginx/access.log main;
+
+    sendfile on;
+    tcp_nopush on;
+    tcp_nodelay on;
+    keepalive_timeout 65;
+    types_hash_max_size 2048;
+    client_max_body_size 50m;
+
+    # Gzip compression
+    gzip on;
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_comp_level 6;
+    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml;
+
+    # Security headers (applied globally — X-Frame-Options set per server block)
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+
+    # Docker internal DNS — enables runtime resolution so nginx starts
+    # even when optional services are not running
+    resolver 127.0.0.11 valid=30s;
+
+    include /etc/nginx/conf.d/*.conf;
+}