inshallah last

nginx/biztaghavi.conf

@@ -1,3 +1,7 @@
+# biztaghavi.com — NODE Cloud origin (ArvanCloud CDN in front)
+# Public SSL: ArvanCloud dashboard → SSL mode "Full", origin 193.105.234.35
+# Origin SSL: shared self-signed cert (required so nginx does not serve Gitea on :443)
+
 gzip on;
 gzip_vary on;
 gzip_proxied any;
@@ -8,11 +12,12 @@ gzip_types text/plain text/css text/xml application/json application/javascript
 server {
     listen 80;
     listen [::]:80;
+    listen 443 ssl;
+    listen [::]:443 ssl;
     server_name biztaghavi.com www.biztaghavi.com;
 
-    # Certbot will insert HTTPS redirect and SSL block here automatically.
-    # After first HTTP deploy, run:
-    #   certbot --nginx -d biztaghavi.com -d www.biztaghavi.com
+    ssl_certificate     /etc/ssl/certs/nodecloud-selfsigned.crt;
+    ssl_certificate_key /etc/ssl/private/nodecloud-selfsigned.key;
 
     client_max_body_size 50M;
 
@@ -32,7 +37,7 @@ server {
         access_log off;
     }
 
-    # Next.js HMR / WebSocket (needed for dev; harmless in prod)
+    # Next.js HMR / WebSocket (dev only; harmless in prod)
     location /_next/webpack-hmr {
         proxy_pass http://127.0.0.1:3009;
         proxy_http_version 1.1;
@@ -50,7 +55,6 @@ server {
         proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
 
-        # WebSocket support
         proxy_set_header Upgrade    $http_upgrade;
         proxy_set_header Connection "upgrade";