Add docker-compose.yml and friends

nginx/Dockerfile

@@ -0,0 +1,9 @@
+FROM nginx:1.27-alpine
+
+RUN apk add --no-cache openssl
+
+COPY docker-entrypoint.sh /docker-entrypoint.sh
+RUN chmod +x /docker-entrypoint.sh
+
+ENTRYPOINT ["/docker-entrypoint.sh"]
+CMD ["nginx", "-g", "daemon off;"]

nginx/conf.d/default.conf

@@ -0,0 +1,55 @@
+limit_req_zone $binary_remote_addr zone=global_rate_limit:10m rate=50r/s;
+
+server {
+  listen 80;
+  server_name localhost host.docker.internal example.com;
+  return 301 https://$host$request_uri;
+}
+
+server {
+  listen 443 ssl;
+  server_name localhost host.docker.internal example.com;
+
+  ssl_certificate /etc/nginx/certs/dev.crt;
+  ssl_certificate_key /etc/nginx/certs/dev.key;
+
+  limit_req zone=global_rate_limit burst=200 nodelay;
+
+  if ($request_uri ~* "//+") {
+    return 308 $scheme://$host$uri$is_args$args;
+  }
+
+  location /api/ {
+    proxy_pass http://api:8000/api/;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+  }
+
+  location /api {
+    return 301 /api/;
+  }
+
+  location = /openapi.json {
+    proxy_pass http://api:8000/openapi.json;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+  }
+
+  location /qr/ {
+    alias /qr/;
+    add_header Cache-Control "public, max-age=31536000, immutable";
+    try_files $uri =404;
+  }
+
+  location / {
+    proxy_pass http://ui:3000/;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+  }
+}

nginx/docker-entrypoint.sh

@@ -0,0 +1,21 @@
+#!/bin/sh
+set -eu
+
+cert_dir="/etc/nginx/certs"
+cert_path="${cert_dir}/dev.crt"
+key_path="${cert_dir}/dev.key"
+
+if [ ! -f "$cert_path" ] || [ ! -f "$key_path" ]; then
+  mkdir -p "$cert_dir"
+  rm -f "$cert_path" "$key_path"
+  openssl req \
+    -x509 \
+    -nodes \
+    -newkey rsa:2048 \
+    -days 365 \
+    -keyout "$key_path" \
+    -out "$cert_path" \
+    -subj "/CN=localhost"
+fi
+
+exec "$@"