From 24686f49658c1c25418c7195811d4c961dec93ce Mon Sep 17 00:00:00 2001
From: febux <deadcove@mail.ru>
Date: Sat, 22 Aug 2026 00:15:24 +0300
Subject: [PATCH] Update front.conf

---
 deploy/vps/front.conf | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/deploy/vps/front.conf b/deploy/vps/front.conf
index ce19ccc..c56f34b 100644
--- a/deploy/vps/front.conf
+++ b/deploy/vps/front.conf
@@ -3,29 +3,35 @@
 #   - «Контракт-чек» (DealDocumentScreening) edge container -> 127.0.0.1:8081
 #   - homelab-stack nginx container                      -> 127.0.0.1:8088
 #
+# TLS: cert obtained on the host (webroot/webroot-nginx), paths below.
+# Renewal: host certbot reuses /.well-known/acme-challenge/ on :80.
+#
 # Install:
 #   sudo cp front.conf /etc/nginx/sites-available/apps
-#   sudo ln -s /etc/nginx/sites-available/apps /etc/nginx/sites-enabled/
-#   sudo rm -f /etc/nginx/sites-enabled/default
+#   sudo ln -s /etc/nginx/sites-available/apps /etc/nginx/sites-enabled/apps
+#   sudo rm -f /etc/nginx/sites-enabled/default /etc/nginx/sites-enabled/legaldoc.tw1.su
 #   sudo nginx -t && sudo systemctl reload nginx
-#
-# TLS later: `sudo certbot --nginx -d your.domain` rewrites the 80-block and
-# adds the 443 server automatically (install python3-certbot-nginx first).
 
 map $http_upgrade $connection_upgrade {
     default upgrade;
     ''      close;
 }
 
-# Backends (containers must publish on 127.0.0.1, see deploy/vps/README or override)
+# Backends (containers publish on 127.0.0.1, see docker-compose.override.example.yml)
 upstream contract_check_edge { server 127.0.0.1:8081; }
 upstream homelab_nginx      { server 127.0.0.1:8088; }
 
 server {
     listen 80 default_server;
     listen [::]:80 default_server;
+    listen 443 ssl default_server;
+    listen [::]:443 ssl default_server;
+    server_name legaldoc.tw1.su;
 
-    # Let's Encrypt renewal (host certbot, webroot mode) — keep even after TLS is on
+    ssl_certificate     /etc/letsencrypt/live/legaldoc.tw1.su/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/legaldoc.tw1.su/privkey.pem;
+
+    # Let's Encrypt renewal (host certbot, webroot mode)
     location /.well-known/acme-challenge/ {
         root /var/www/html;
     }
@@ -55,7 +61,7 @@ server {
     }
 
     # ── everything else: homelab-stack (landing page, /homepage/, /dozzle/, ...)
-    location /dashboard {
+    location / {
         proxy_pass http://homelab_nginx;
         proxy_http_version 1.1;
         proxy_set_header Host              $host;