feat: add huddle redirect

Restructures the location block to avoid the nginx "if is evil" pattern
where add_header directives inside an if block suppress those in the
parent location context. Also adds Access-Control-Max-Age and removes
POST from allowed methods since the CDN serves static assets only.

nginx/nginx/cloudflare_ips.conf

@@ -1,5 +1,5 @@
 # Auto-generated Cloudflare IP ranges
-# Updated: Thu Apr 16 10:50:50 PM PDT 2026
+# Updated: Wed Jun 10 10:59:21 PM PDT 2026
 
 real_ip_header CF-Connecting-IP;
 

nginx/nginx/conf.d/redirects.conf

@@ -123,6 +123,17 @@ server {
   include /etc/nginx/snippets/deny-dotfiles.conf;
 }
 
+# huddle.nhcarrigan.com → zcal scheduling
+server {
+  listen 443 ssl;
+  server_name huddle.nhcarrigan.com;
+  ssl_certificate /etc/letsencrypt/live/huddle.nhcarrigan.com/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/huddle.nhcarrigan.com/privkey.pem;
+
+  return 301 https://zcal.co/nhcarrigan/huddle;
+  include /etc/nginx/snippets/deny-dotfiles.conf;
+}
+
 # tasks.nhcarrigan.com → melody
 server {
   listen 443 ssl;

nginx/nginx/sites-available/cdn.conf

@@ -18,7 +18,18 @@ server {
         return 301 $scheme://$host/avatars/$1;
     }
 
+    # Handle CORS preflight requests without the "if is evil" pattern.
     location / {
+        if ($request_method = OPTIONS) {
+            add_header Access-Control-Allow-Origin "*" always;
+            add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+            add_header Access-Control-Allow-Headers "DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range" always;
+            add_header Access-Control-Max-Age 86400 always;
+            add_header Content-Type "text/plain; charset=utf-8";
+            add_header Content-Length 0;
+            return 204;
+        }
+
         proxy_pass https://nhcarrigan.hel1.your-objectstorage.com;
         proxy_set_header Host nhcarrigan.hel1.your-objectstorage.com;
 
@@ -32,22 +43,12 @@ server {
         proxy_set_header x-amz-date "";
         proxy_set_header x-amz-security-token "";
 
-        add_header X-Debug-Cdn "Proxy-Active" always;
-
         proxy_hide_header Access-Control-Allow-Origin;
 
+        add_header X-Debug-Cdn "Proxy-Active" always;
         add_header Access-Control-Allow-Origin "*" always;
-        add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
+        add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
         add_header Access-Control-Allow-Headers "DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range" always;
-
-        if ($request_method = 'OPTIONS') {
-            add_header Access-Control-Allow-Origin "*" always;
-            add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
-            add_header Access-Control-Allow-Headers "DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range" always;
-            add_header Content-Type "text/plain; charset=utf-8";
-            add_header Content-Length 0;
-            return 204;
-        }
     }
   include /etc/nginx/snippets/deny-dotfiles.conf;
 }

nginx/nginx/sites-available/cipher.conf

@@ -0,0 +1,25 @@
+# Cipher - Bluesky collections archive.
+server {
+  listen 443 ssl;
+  server_name cipher.nhcarrigan.com;
+  ssl_certificate /etc/letsencrypt/live/cipher.nhcarrigan.com/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/cipher.nhcarrigan.com/privkey.pem;
+
+  root /home/naomi/cipher;
+
+  location = / {
+    try_files /site.html =404;
+  }
+
+  location = /data.json {
+    default_type application/json;
+    add_header Content-Type "application/json; charset=utf-8";
+  }
+
+  # Everything else gets the global 404
+  location / {
+    return 404;
+  }
+
+  include /etc/nginx/snippets/deny-dotfiles.conf;
+}

nginx/nginx/sites-available/content.conf

@@ -1,5 +1,4 @@
-# Static content and publishing sites: blog, books, donate, music, secrets, style, testimonials.
+# Static content and publishing sites: blog, books, donate, music, personality, secrets, style, testimonials.
-
 server {
   listen 443 ssl;
   server_name blog.nhcarrigan.com;
@@ -46,6 +45,34 @@ server {
   include /etc/nginx/snippets/deny-dotfiles.conf;
 }
 
+server {
+  listen 443 ssl;
+  server_name grimoire.nhcarrigan.com;
+  ssl_certificate /etc/letsencrypt/live/grimoire.nhcarrigan.com/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/grimoire.nhcarrigan.com/privkey.pem;
+
+  root /home/naomi/grimoire;
+
+  location / {
+    index index.html;
+  }
+  include /etc/nginx/snippets/deny-dotfiles.conf;
+}
+
+server {
+  listen 443 ssl;
+  server_name memes.nhcarrigan.com;
+  ssl_certificate /etc/letsencrypt/live/memes.nhcarrigan.com/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/memes.nhcarrigan.com/privkey.pem;
+
+  root /home/naomi/memes;
+
+  location / {
+    index index.html;
+  }
+  include /etc/nginx/snippets/deny-dotfiles.conf;
+}
+
 server {
   listen 443 ssl;
   server_name music.nhcarrigan.com;
@@ -64,6 +91,20 @@ server {
   include /etc/nginx/snippets/deny-dotfiles.conf;
 }
 
+server {
+  listen 443 ssl;
+  server_name personality.nhcarrigan.com;
+  ssl_certificate /etc/letsencrypt/live/personality.nhcarrigan.com/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/personality.nhcarrigan.com/privkey.pem;
+
+  root /home/naomi/personality/dist;
+
+  location / {
+    index index.html;
+  }
+  include /etc/nginx/snippets/deny-dotfiles.conf;
+}
+
 server {
   listen 443 ssl;
   server_name secrets.nhcarrigan.com;

nginx/nginx/sites-available/img.conf

@@ -0,0 +1,36 @@
+server {
+    listen 443 ssl;
+    server_name img.nhcarrigan.com;
+    ssl_certificate /etc/letsencrypt/live/img.nhcarrigan.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/img.nhcarrigan.com/privkey.pem;
+
+    # allow large file uploads
+    client_max_body_size 50000M;
+
+    # disable buffering uploads to prevent OOM on reverse proxy server and make uploads twice as fast (no pause)
+    proxy_request_buffering off;
+
+    # increase body buffer to avoid limiting upload speed
+    client_body_buffer_size 1024k;
+
+    # Set headers
+    proxy_set_header Host              $host;
+    proxy_set_header X-Real-IP         $remote_addr;
+    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+
+    # enable websockets: http://nginx.org/en/docs/http/websocket.html
+    proxy_http_version 1.1;
+    proxy_redirect     off;
+
+    # set timeout
+    proxy_read_timeout 600s;
+    proxy_send_timeout 600s;
+    send_timeout       600s;
+
+    location / {
+        proxy_pass http://127.0.0.1:2283;
+        proxy_set_header   Upgrade    $http_upgrade;
+        proxy_set_header   Connection "upgrade";
+    }
+}

nginx/nginx/sites-available/learn.conf

@@ -0,0 +1,13 @@
+server {
+  listen 443 ssl;
+  server_name learn.nhcarrigan.com;
+  ssl_certificate /etc/letsencrypt/live/learn.nhcarrigan.com/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/learn.nhcarrigan.com/privkey.pem;
+
+  root /home/naomi/learn/dist;
+
+  location / {
+    index index.html;
+  }
+  include /etc/nginx/snippets/deny-dotfiles.conf;
+}

nginx/nginx/sites-available/workshops.conf

@@ -0,0 +1,15 @@
+# Workshops Angular SPA (companion guides for live workshops).
+server {
+  listen 443 ssl;
+  server_name workshops.nhcarrigan.com;
+  ssl_certificate /etc/letsencrypt/live/workshops.nhcarrigan.com/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/workshops.nhcarrigan.com/privkey.pem;
+
+  root /home/naomi/workshops/dist/workshops/browser;
+  index index.html;
+
+  location / {
+    try_files $uri $uri/ /index.html;
+  }
+  include /etc/nginx/snippets/deny-dotfiles.conf;
+}

nginx/nginx/sites-enabled/cipher.conf

@@ -0,0 +1 @@
+../sites-available/cipher.conf

nginx/nginx/sites-enabled/img.conf

@@ -0,0 +1 @@
+../sites-available/img.conf

nginx/nginx/sites-enabled/learn.conf

@@ -0,0 +1 @@
+../sites-available/learn.conf

nginx/nginx/sites-enabled/workshops.conf

@@ -0,0 +1 @@
+../sites-available/workshops.conf

sites-enabled

@@ -0,0 +1 @@
+sites-available/img.conf