# Server — nginx

> **Last updated:** 2026-07-06  
> Config live di server — verifikasi via SSH sebelum mengandalkan docs.

| Item | Nilai |
|------|-------|
| Host | `proxy.lan` / `10.100.1.24` |
| SSH | `ssh reverse-proxy` |
| nginx | 1.27 |
| SSL wildcard | `/home/ssl-gisportal/gisportal.id-fullchain.pem` |
| SSL geonet | `/etc/nginx/sslgeonet.co.id/` |
| Docker stacks | `/opt/stacks/` (Dockge) |

---

## Struktur config

```
/etc/nginx/nginx.conf
  include conf.d/*.conf
  include conf.d/production/*.conf
  include conf.d/development/*.conf
```

| Path | Fungsi |
|------|--------|
| `conf.d/ssl.conf` | SSL global |
| `conf.d/default-wildcard.conf` | catch-all → redirect support-portal |
| `conf.d/production/` | vhost produksi |
| `conf.d/development/` | vhost dev |
| `conf.d/nonaktif/` | tidak diload |

Reload: `nginx -t && nginx -s reload`

---

## DNS (split-DNS MikroTik `10.100.1.1`)

| Pattern | Target | Catatan |
|---------|--------|---------|
| `^dev\.gisportal\.id` | `10.100.1.51` | bypass reverse-proxy |
| `\.gisportal\.id` | `10.100.1.24` | catch-all |
| `iguf.geonet.co.id` | `10.100.1.24` | `geonet.iguf.conf` |

**DNS publik:**

| Domain | IP publik | NAT → |
|--------|-----------|-------|
| `dev.gisportal.id` | `117.102.73.100` | `10.100.1.51:443` |
| `*.gisportal.id` | `117.102.73.102` | `10.100.1.24:443` |
| `iguf.geonet.co.id` | `117.102.73.99` | `10.100.1.24:443` |
| `sync.geonet.co.id` | `117.102.73.102` | `10.100.1.24:443` → `10.100.1.28` |

---

## Domain kunci

| Domain | Backend |
|--------|---------|
| `console.gisportal.id` | geonet-console Docker |
| `my.gisportal.id` | mysupperapps FE |
| `zammad.gisportal.id` | `127.0.0.1:8093` |
| `sync.geonet.co.id` | `https://10.100.1.28:443` |
| `agent.gisportal.id` | GeoNetAgent collector |
| `file.gisportal.id` | QNAP `10.100.1.10` |
| `git.gisportal.id` | Gitea `10.100.1.41:3000` |
| `dockge.gisportal.id` | Dockge UI |

Template vhost di repo app: `Mailcow/infra/nginx/`, `Zammad/infra/nginx/`, `GeoNetAgent/infra/nginx/`.

---

## SSL / HTTP2

Cipher lemah (RC4, SSLv3) → `ERR_HTTP2_INADEQUATE_TRANSPORT_SECURITY`.

```nginx
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
```

---

## Mapping ke monorepo

| Repo | Config template |
|------|-----------------|
| Mailcow | `Mailcow/infra/nginx/sync.geonet.co.id.conf` |
| Zammad | `Zammad/infra/nginx/zammad.gisportal.id.conf` |
| GeoNetAgent | `GeoNetAgent/infra/nginx/` |

**Deprecated:** `server-audit/.cursor/infra-reverse-proxy.md` → gunakan file ini.