Not deployed yet." \
> "$BASE/releases/bootstrap/frontend/index.html"
chown -R "$DEPLOY_USER:$DEPLOY_USER" "$BASE/releases/bootstrap"
ln -sfn "$BASE/releases/bootstrap" "$BASE/current"
chown -h "$DEPLOY_USER:$DEPLOY_USER" "$BASE/current"
fi
echo "==> nginx catch-all (multi-tenant: one bundle serves every domain)"
cat > /etc/nginx/sites-available/marketplaces.conf <<'NGINX'
# Multi-tenant by design: the SPA derives its tenant from the Host header,
# so ONE server block serves every customer domain. Do not add a per-tenant
# root here. Per-domain server blocks exist only to hold TLS certificates
# (see add-domain.sh) and proxy to this same root.
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name _;
root /srv/marketplaces/current/frontend;
index index.html;
access_log /var/log/nginx/marketplaces.access.log;
error_log /var/log/nginx/marketplaces.error.log;
# Do not let the browser cache the app shell: a deploy must take effect
# on the next reload, not whenever a stale index.html expires.
location = /index.html {
add_header Cache-Control "no-store, must-revalidate" always;
try_files $uri =404;
}
# Hashed build artifacts are immutable by construction.
location ~* \.(js|css|woff2?|png|jpe?g|svg|gif|webp|avif|ico)$ {
expires 1y;
add_header Cache-Control "public, immutable" always;
try_files $uri =404;
}
location /health {
access_log off;
return 200 "ok\n";
add_header Content-Type text/plain;
}
location /api/ {
proxy_pass http://127.0.0.1:8080;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 60s;
}
# SPA fallback. Must stay last: every unmatched path is a client route.
location / {
try_files $uri $uri/ /index.html;
}
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
gzip on;
gzip_types text/plain text/css application/javascript application/json image/svg+xml;
gzip_min_length 1024;
}
NGINX
ln -sfn /etc/nginx/sites-available/marketplaces.conf /etc/nginx/sites-enabled/marketplaces.conf
rm -f /etc/nginx/sites-enabled/default
echo "==> firewall"
ufw allow OpenSSH >/dev/null
ufw allow 80/tcp >/dev/null
ufw allow 443/tcp >/dev/null
ufw --force enable >/dev/null
echo "==> nginx config test"
nginx -t
systemctl enable --now nginx
systemctl reload nginx
echo "==> sudoers: let the deploy user reload nginx, nothing else"
cat > /etc/sudoers.d/marketplaces-deploy <