View source for Services/VpsNginx

''As of: 2026-07-05 — migrated from `services/VPS-NGINX.md`''

= VPS nginx — vhost management scripts =

Reference for the RackNerd VPS (100.67.169.50, public-facing) that reverse-proxies every <code>*.wilsoz.com</code> subdomain back to stronghold over Tailscale (100.64.207.155). Read this before hand-writing an nginx vhost — as of 2026-07-05 there are scripts that do the whole thing in one command.

== Scripts (on the VPS, <code>/home/mnw/</code>) ==

{| class="wikitable"
|-
! Script
! Purpose
|-
| <code>add-vhost.sh</code>
| Create a vhost, symlink it, get a cert, add security headers, reload, verify — one command
|-
| <code>remove-vhost.sh</code>
| Tear a vhost down: remove symlink, delete/revoke cert, delete vhost file, reload
|-
| <code>VHOST-HOWTO.md</code>
| Full usage doc, lives alongside the scripts on the VPS
|}

=== Add a site ===

<syntaxhighlight lang="bash">
sudo /home/mnw/add-vhost.sh <domain> <tailscale-ip:port>
# Example:
sudo /home/mnw/add-vhost.sh wiki.wilsoz.com 100.64.207.155:9926
</syntaxhighlight>

Does, in order: writes <code>/etc/nginx/sites-available/<domain></code> with a plain HTTP proxy block → symlinks into <code>sites-enabled/</code> → <code>nginx -t</code> + reload → <code>certbot --nginx -d <domain></code> (Cloudflare DNS-01, rewrites the file with the SSL block + 80→443 redirect, same as every other cert on this VPS) → injects <code>include /etc/nginx/snippets/security-headers.conf;</code> right after certbot's <code>options-ssl-nginx.conf</code> line → final <code>nginx -t</code> + reload → <code>curl</code> status check.

'''Prerequisites before running:''' DNS A record for the domain already pointing at the VPS (100.67.169.50); the backend already up and reachable on stronghold at the given port. WebSocket backends need <code>proxy_http_version 1.1</code> + <code>Upgrade</code>/<code>Connection</code> headers added manually afterward — the script doesn't detect that case.

=== Remove a site ===

<syntaxhighlight lang="bash">
sudo /home/mnw/remove-vhost.sh <domain>
</syntaxhighlight>

Shows you the backend it's about to remove, asks whether to '''revoke''' the cert (<code>y</code> = revoke + delete, use when the domain is gone for good; default <code>N</code> = delete locally only, use when just moving/rebuilding), removes the <code>sites-enabled</code> symlink, deletes the vhost file, tests + reloads nginx.

== Server topology ==

{| class="wikitable"
|-
! Thing
! Value
|-
| Public VPS
| 100.67.169.50 (RackNerd)
|-
| Home server (stronghold)
| 100.64.207.155 (Tailscale)
|-
| Backend ports (examples)
| 9925 = Mealie, 9926 = MediaWiki
|-
| Cert method
| Let's Encrypt via certbot + Cloudflare DNS-01 (same plugin as <code>mymail.wilsoz.com</code>, see CLAUDE.md)
|-
| HSTS
| <code>max-age=300</code> — staged rollout, expect this to increase over time
|}

== Known nginx warnings (harmless, pre-existing) ==

<code>nginx -t</code> shows an <code>ssl_protocols</code> redefinition warning for <code>pages.git.wilsoz.com</code> and <code>photos.wilsoz.com</code>, and will show the same for any vhost combining <code>options-ssl-nginx.conf</code> (certbot) with <code>security-headers.conf</code>. Cosmetic only — config still loads and serves correctly.

== Gotcha ==

<code>add-vhost.sh</code> aborts rather than overwriting if the vhost file already exists — safe to run repeatedly/accidentally, but means you must <code>remove-vhost.sh</code> first (or hand-edit) to change an existing site's backend port.