# Reverse Proxy — nginx (10.100.1.24 / proxy.lan)

> **Deprecated** — SSOT pindah ke [`nginx/docs/server.md`](../../nginx/docs/server.md).  
> File ini dipertahankan sebagai redirect; jangan update di sini.

Dokumentasi infrastruktur reverse-proxy untuk AI Agent. **Bukan** sumber kebenaran config live — selalu verifikasi di server.

## Peran server

| Item | Nilai |
|------|-------|
| Host | `proxy.lan` / `10.100.1.24` |
| SSH | `ssh reverse-proxy` atau `ssh -m hmac-sha1 root@10.100.1.24 -p 22` |
| Stack | nginx 1.27, Docker (Dockge `/opt/stacks/`) |
| Sertifikat wildcard | `/home/ssl-gisportal/gisportal.id-fullchain.pem` |
| Sertifikat geonet | `/etc/nginx/sslgeonet.co.id/` |

## DNS (MikroTik split-DNS — 10.100.1.1)

| Pattern / name | Target | Keterangan |
|----------------|--------|------------|
| `^dev\.gisportal\.id` | `10.100.1.51` | Dev IIS — **tidak** lewat reverse-proxy |
| `\.gisportal\.id` (catch-all) | `10.100.1.24` | Semua subdomain lain |
| `iguf.geonet.co.id` | `10.100.1.24` | vhost terpisah (`geonet.iguf.conf`) |

**DNS publik:**

| Domain | IP publik | NAT → |
|--------|-----------|-------|
| `dev.gisportal.id` | `117.102.73.100` | `10.100.1.51:443` |
| `*.gisportal.id` (umum) | `117.102.73.102` | `10.100.1.24:443` |
| `iguf.geonet.co.id` | `117.102.73.99` | `10.100.1.24:443` |

## Struktur nginx

```
/etc/nginx/nginx.conf
  include conf.d/*.conf
  include conf.d/production/*.conf
  include conf.d/development/*.conf
```

| Path | Fungsi |
|------|--------|
| `conf.d/ssl.conf` | Template SSL global (di-include vhost HTTPS) |
| `conf.d/default-wildcard.conf` | `server_name _` → redirect `app.gisportal.id/support-portal/` |
| `conf.d/production/` | vhost produksi |
| `conf.d/development/` | vhost development |
| `conf.d/nonaktif/` | **Tidak diload** — config lama |

## Domain kunci (verified 2026-06-17)

| Domain | Config | Backend |
|--------|--------|---------|
| `iguf.geonet.co.id` | `conf.d/geonet.iguf.conf` | `https://10.100.1.41:1443/iguf/` |
| `file.gisportal.id` | `conf.d/nas.conf` | `https://10.100.1.10` (QNAP) |
| `git.gisportal.id` | `conf.d/production/git.conf` | `http://10.100.1.41:3000` (Gitea) |
| `dev.gisportal.id` | *(nonaktif di nginx)* | Langsung `10.100.1.51` via DNS |

## SSL / HTTP2 (penting)

Browser modern (Edge/Chrome) memakai HTTP/2. Cipher berikut **dilarang** untuk HTTP/2:

- `RC4`, `SSLv3`, cipher lemah lainnya

**Setting saat ini** (`ssl.conf`, sejak 2026-06-17):

```nginx
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:...;
ssl_prefer_server_ciphers off;
```

Backup sebelum perubahan: `ssl.conf.bak.20260617`

**Gejala jika SSL salah:** `ERR_HTTP2_INADEQUATE_TRANSPORT_SECURITY` di browser; `curl` HTTP/1.1 masih 200.

## Reload nginx

```bash
nginx -t && nginx -s reload
```

## Subdomain tanpa vhost

Jika subdomain resolve ke `10.100.1.24` tetapi **tidak** ada `server_name` di nginx → kena `default-wildcard.conf` (redirect support-portal). Contoh yang pernah bermasalah: `iguf.gisportal.id` (domain aktif: `iguf.geonet.co.id`).