# Central Nginx Routing Setup - Complete

**Last Updated:** 2025-12-27  
**Document Version:** 1.0  
**Status:** Active Documentation

---

## Architecture

```
Internet → Cloudflare → cloudflared (VMID 102) → Nginx Proxy Manager (VMID 105:80) → Internal Services
```

All Cloudflare tunnel traffic now routes through a single Nginx instance (VMID 105) which then routes to internal services based on hostname.

---

## Configuration Complete

### ✅ Nginx Proxy Manager (VMID 105)

**IP Address**: `192.168.11.21`  
**Configuration File**: `/data/nginx/custom/http.conf`  
**Status**: Active and running

**Services Configured**:

| Domain | Routes To | Service IP | Service Port |
|--------|-----------|------------|--------------|
| `explorer.d-bis.org` | `http://192.168.11.280:80` | 192.168.11.280 | 80 |
| `rpc-http-pub.d-bis.org` | `https://192.168.11.252:443` | 192.168.11.252 | 443 |
| `rpc-ws-pub.d-bis.org` | `https://192.168.11.252:443` | 192.168.11.252 | 443 |
| `rpc-http-prv.d-bis.org` | `https://192.168.11.251:443` | 192.168.11.251 | 443 |
| `rpc-ws-prv.d-bis.org` | `https://192.168.11.251:443` | 192.168.11.251 | 443 |
| `dbis-admin.d-bis.org` | `http://192.168.11.130:80` | 192.168.11.130 | 80 |
| `dbis-api.d-bis.org` | `http://192.168.11.290:3000` | 192.168.11.290 | 3000 |
| `dbis-api-2.d-bis.org` | `http://192.168.11.291:3000` | 192.168.11.291 | 3000 |
| `mim4u.org` | `http://192.168.11.19:80` | 192.168.11.19 | 80 |
| `www.mim4u.org` | `http://192.168.11.19:80` | 192.168.11.19 | 80 |

---

## Cloudflare Tunnel Configuration

### ⚠️ Action Required: Update Cloudflare Dashboard

Since the tunnel uses token-based configuration, you need to update the tunnel ingress rules in the Cloudflare dashboard:

1. Go to: https://one.dash.cloudflare.com/
2. Navigate to: **Zero Trust** → **Networks** → **Tunnels**
3. Select your tunnel (ID: `b02fe1fe-cb7d-484e-909b-7cc41298ebe8`)
4. Click **Configure** → **Public Hostnames**
5. Update all hostnames to route to: `http://192.168.11.21:80`

### Required Tunnel Ingress Rules

All hostnames should route to the central Nginx:

```yaml
ingress:
  # Explorer
  - hostname: explorer.d-bis.org
    service: http://192.168.11.21:80
  
  # RPC Public
  - hostname: rpc-http-pub.d-bis.org
    service: http://192.168.11.21:80
  
  - hostname: rpc-ws-pub.d-bis.org
    service: http://192.168.11.21:80
  
  # RPC Private
  - hostname: rpc-http-prv.d-bis.org
    service: http://192.168.11.21:80
  
  - hostname: rpc-ws-prv.d-bis.org
    service: http://192.168.11.21:80
  
  # DBIS Services
  - hostname: dbis-admin.d-bis.org
    service: http://192.168.11.21:80
  
  - hostname: dbis-api.d-bis.org
    service: http://192.168.11.21:80
  
  - hostname: dbis-api-2.d-bis.org
    service: http://192.168.11.21:80
  
  # Miracles In Motion
  - hostname: mim4u.org
    service: http://192.168.11.21:80
  
  - hostname: www.mim4u.org
    service: http://192.168.11.21:80
  
  # Catch-all
  - service: http_status:404
```

---

## Testing

### Test Nginx Routing Locally

```bash
# Test Explorer
curl -H "Host: explorer.d-bis.org" http://192.168.11.21/

# Test RPC Public HTTP
curl -H "Host: rpc-http-pub.d-bis.org" http://192.168.11.21/ \
  -X POST -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}'
```

### Test Through Cloudflare (After Tunnel Update)

```bash
# Test Explorer
curl https://explorer.d-bis.org/

# Test RPC Public
curl -X POST https://rpc-http-pub.d-bis.org \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}'
```

---

## Benefits

1. **Single Point of Configuration**: All routing logic in one place (VMID 105)
2. **Simplified Management**: No need to update multiple Nginx instances
3. **Centralized Logging**: All traffic logs in one location
4. **Easier Troubleshooting**: Single point to check routing issues
5. **Consistent Configuration**: All services follow the same routing pattern

---

## Maintenance

### View Nginx Configuration

```bash
ssh root@192.168.11.12 "pct exec 105 -- cat /data/nginx/custom/http.conf"
```

### Reload Nginx Configuration

```bash
ssh root@192.168.11.12 "pct exec 105 -- systemctl restart npm"
```

### Add New Service

1. Edit `/data/nginx/custom/http.conf` on VMID 105
2. Add new `server` block with appropriate `server_name` and `proxy_pass`
3. Test: `nginx -t`
4. Reload: `systemctl restart npm`
5. Update Cloudflare tunnel to route new hostname to `http://192.168.11.21:80`

---

## Troubleshooting

### Service Not Routing Correctly

1. Check Nginx configuration: `pct exec 105 -- nginx -t`
2. Check service status: `pct exec 105 -- systemctl status npm`
3. Check Nginx logs: `pct exec 105 -- tail -f /data/logs/fallback_error.log`
4. Verify internal service is accessible: `curl http://<service-ip>:<port>`

### Cloudflare Tunnel Not Connecting

1. Check tunnel status: `pct exec 102 -- systemctl status cloudflared`
2. Verify tunnel configuration in Cloudflare dashboard
3. Check tunnel logs: `pct exec 102 -- journalctl -u cloudflared -n 50`

---

## Next Steps

1. ✅ Nginx configuration deployed
2. ⏳ **Update Cloudflare tunnel configuration** (see above)
3. ⏳ Test all endpoints after tunnel update
4. ⏳ Monitor logs for any routing issues

---

**Configuration File Location**: `/data/nginx/custom/http.conf` on VMID 105

---

## Related Documentation

> **Master Reference:** For a consolidated view of all Cloudflare routing, see **[CLOUDFLARE_ROUTING_MASTER.md](CLOUDFLARE_ROUTING_MASTER.md)** ⭐⭐⭐.

### Setup Guides
- **[../04-configuration/cloudflare/CLOUDFLARE_ZERO_TRUST_GUIDE.md](../04-configuration/cloudflare/CLOUDFLARE_ZERO_TRUST_GUIDE.md)** ⭐⭐⭐ - Complete Cloudflare Zero Trust setup
- **[../04-configuration/cloudflare/CLOUDFLARE_TUNNEL_INSTALLATION.md](../04-configuration/cloudflare/CLOUDFLARE_TUNNEL_INSTALLATION.md)** ⭐⭐ - Tunnel installation procedures
- **[../04-configuration/cloudflare/CLOUDFLARE_DNS_TO_CONTAINERS.md](../04-configuration/cloudflare/CLOUDFLARE_DNS_TO_CONTAINERS.md)** ⭐⭐⭐ - DNS mapping to containers

### Architecture Documents
- **[CLOUDFLARE_TUNNEL_ROUTING_ARCHITECTURE.md](CLOUDFLARE_TUNNEL_ROUTING_ARCHITECTURE.md)** ⭐⭐⭐ - Complete Cloudflare tunnel routing architecture
- **[CLOUDFLARE_NGINX_INTEGRATION.md](CLOUDFLARE_NGINX_INTEGRATION.md)** ⭐⭐ - Cloudflare + NGINX integration
- **[NGINX_ARCHITECTURE_RPC.md](NGINX_ARCHITECTURE_RPC.md)** ⭐⭐ - NGINX RPC architecture

---

**Last Updated:** 2025-12-27  
**Document Version:** 1.0  
**Review Cycle:** Quarterly

