Add private Docker UI relay for Nginx Proxy Manager

2026-10-10 09:13:50 +03:30
parent 55f11c9956
commit 1539f067f9
6 changed files with 159 additions and 7 deletions
@@ -55,3 +55,19 @@ rtk python3 scripts/check_receipts.py --credentials esp32-test-kit/connection.tx
 ```

 The script allows bounded waiting for UI evidence (default15 seconds), reports transient HTTP failures and still fails if matching evidence never appears. The old tunnel timeout was not reproduced; no historical root cause is claimed. Broker restart/persistence verification remains a separate Sprint5 gate.
+
+## Nginx Proxy Manager setup for shop.my-mm.ir
+
+Docker `ui-proxy` listens only on the private Docker gateway `172.20.0.1:18082` and forwards read-only requests to the backend's loopback viewer. NPM already has a network with this gateway. The public server IP has no new UI listener. The relay rewrites Host/Origin for the private viewer and streams SSE without buffering. Both backend and relay must pass deployment health checks; rollback removes only orphan services in this backend Compose project.
+
+In NPM, add a Proxy Host:
+
+- Domain Names: `shop.my-mm.ir`
+- Scheme: `http`
+- Forward Hostname/IP: `172.20.0.1`
+- Forward Port: `18082`
+- Cache Assets: off
+- Advanced: `proxy_buffering off;` and `proxy_read_timeout 3600s;`
+- SSL: request a new Let's Encrypt certificate for the domain, then enable Force SSL.
+
+DNS already points to109.122.252.129. NPM owns domain/TLS settings; this task does not modify its routes or certificates. If its Docker network is recreated with a different gateway, update the relay listener/healthcheck and NPM upstream together. Keep the backend itself at127.0.0.1:18080.