refactor: restructure nginx config into per-app files (#1)

## Summary - Added `push.sh` script to deploy configs to prod via `sudo rsync` (with `--delete` for exact mirroring) - Split the monolithic `conf.d/server.conf` (1,682 lines, 96 server blocks) into 28 per-app files under `sites-available/`, with corresponding symlinks in `sites-enabled/` - Extracted custom `nginx.conf` settings (`log_format` directives, `server_names_hash_bucket_size`) into dedicated `conf.d/logging.conf` and `conf.d/tuning.conf` files, leaving `nginx.conf` as close to stock as possible ## Test plan - [x] `sudo nginx -t` passes on prod after the sites-available restructure ✨ This PR was created with help from Hikari~ 🌸 Co-authored-by: Naomi Carrigan <commits@nhcarrigan.com> Reviewed-on: #1 Co-authored-by: Hikari <hikari@nhcarrigan.com> Co-committed-by: Hikari <hikari@nhcarrigan.com>
2026-03-07 02:05:29 -08:00
parent d06178c01b
commit db36f98578
79 changed files with 2800 additions and 979 deletions
@@ -0,0 +1,163 @@
+# Personal portfolio and vanity domains (naomi.lgbt, naomi.party, nhcarrigan.com, nhcarrigan.link, resume)
+# plus a wildcard catch-all that redirects *.naomi.lgbt → *.nhcarrigan.com.
+server {
+  listen 443 ssl;
+  server_name naomi.lgbt;
+  ssl_certificate /etc/letsencrypt/live/naomi.lgbt/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/naomi.lgbt/privkey.pem;
+
+  root /home/naomi/portfolio/site;
+
+  location / {
+    index index.html;
+  }
+
+  location /ads.txt {
+    add_header Content-Type text/plain;
+    return 200 "google.com, pub-3569924701890974, DIRECT, f08c47fec0942fa0";
+  }
+
+  location /games {
+    try_files /games.html =404;
+  }
+
+  location /koikatsu {
+    try_files /koikatsu.html =404;
+  }
+}
+
+server {
+  listen 443 ssl;
+  server_name naomi.party;
+  ssl_certificate /etc/letsencrypt/live/naomi.party/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/naomi.party/privkey.pem;
+
+  root /home/naomi/bsky;
+
+  location / {
+    index index.html;
+  }
+
+  location /ads.txt {
+    add_header Content-Type text/plain;
+    return 200 "google.com, pub-3569924701890974, DIRECT, f08c47fec0942fa0";
+  }
+}
+
+server {
+  listen 443 ssl;
+  server_name nhcarrigan.com;
+  ssl_certificate /etc/letsencrypt/live/nhcarrigan.com/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/nhcarrigan.com/privkey.pem;
+
+  root /home/naomi/portfolio/site;
+
+  location /ads.txt {
+    add_header Content-Type text/plain;
+    return 200 "google.com, pub-3569924701890974, DIRECT, f08c47fec0942fa0";
+  }
+
+  location / {
+    index index.html;
+  }
+
+  location /games {
+    try_files /games.html =404;
+  }
+
+  location /koikatsu {
+    try_files /koikatsu.html =404;
+  }
+}
+
+server {
+  listen 443 ssl;
+  server_name nhcarrigan.link;
+  ssl_certificate /etc/letsencrypt/live/nhcarrigan.link/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/nhcarrigan.link/privkey.pem;
+
+  root /home/naomi/link-redirector;
+
+  location / {
+    index index.html;
+  }
+
+  location /ads.txt {
+    add_header Content-Type text/plain;
+    return 200 "google.com, pub-3569924701890974, DIRECT, f08c47fec0942fa0";
+  }
+}
+
+server {
+  listen 443 ssl;
+  server_name resume.nhcarrigan.com;
+  ssl_certificate /etc/letsencrypt/live/resume.nhcarrigan.com/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/resume.nhcarrigan.com/privkey.pem;
+
+  root /home/naomi/resume/site;
+
+  location /resume.yaml {
+    default_type text/plain;
+    add_header Content-Type "text/plain; charset=utf-8";
+  }
+
+  location / {
+    index index.html;
+    try_files $uri $uri/ /index.html;
+  }
+}
+
+server {
+  listen 443 ssl;
+  server_name www.naomi.lgbt;
+  ssl_certificate /etc/letsencrypt/live/www.naomi.lgbt/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/www.naomi.lgbt/privkey.pem;
+
+  root /home/naomi/portfolio/site;
+
+  location / {
+    index index.html;
+  }
+
+  location /games {
+    try_files /games.html =404;
+  }
+
+  location /koikatsu {
+    try_files /koikatsu.html =404;
+  }
+}
+
+server {
+  listen 443 ssl;
+  server_name www.nhcarrigan.com;
+  ssl_certificate /etc/letsencrypt/live/www.nhcarrigan.com/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/www.nhcarrigan.com/privkey.pem;
+
+  root /home/naomi/portfolio/site;
+
+  location / {
+    index index.html;
+  }
+
+  location /games {
+    try_files /games.html =404;
+  }
+
+  location /koikatsu {
+    try_files /koikatsu.html =404;
+  }
+}
+
+# Wildcard catch-all — must remain last so specific subdomains take priority
+server {
+    listen 443 ssl;
+    server_name ~^(?<subdomain>.+)\.naomi\.lgbt$;
+
+    ssl_certificate     /etc/letsencrypt/live/*.naomi.lgbt/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/*.naomi.lgbt/privkey.pem;
+
+    location / {
+        return 301 https://$subdomain.nhcarrigan.com$request_uri;
+    }
+}