Sosyabot Docs

English

Türkçe

English

Türkçe

Appearance

nginx ​

nginx fronts every Sosyabot component with TLS. Three vhosts, one HTTPS cert per host (Let's Encrypt via Certbot is the default).

The three vhosts ​

app.sosyabot.com       →  127.0.0.1:${PORT:-4200}        (backend; serves frontend bundle)
sosyabot.com           →  127.0.0.1:${LANDING_PORT:-4201} (landing site)
docs.sosyabot.com      →  127.0.0.1:${DOCS_PORT:-4202}   (docs site)

Example vhost (docs) ​

nginx
server {
    server_name docs.sosyabot.com;

    location / {
        proxy_pass http://127.0.0.1:4202;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
    }

    listen 443 ssl;                                    # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/docs.sosyabot.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/docs.sosyabot.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
}

server {
    if ($host = docs.sosyabot.com) {
        return 301 https://$host$request_uri;
    }
    server_name docs.sosyabot.com;
    listen 80;
    return 404;
}

The landing vhost follows the same pattern with a different upstream port. The app vhost does not — it needs three directives the docs vhost has no use for.

Example vhost (app) ​

nginx
server {
    server_name app.sosyabot.com;

    # Media uploads. nginx's default body limit is 1 MB, so without this every
    # image or video upload fails with 413 before it reaches the backend.
    client_max_body_size 100M;

    # A long-lived SPA session sends far more requests over one connection than
    # the default limit allows. When nginx hits it and closes the socket, every
    # request already in flight surfaces in the browser as net::ERR_FAILED.
    # http2_max_requests governs HTTP/2, keepalive_requests the HTTP/1.1
    # fallback; both paths are reachable, so raise both.
    http2_max_requests 10000;
    keepalive_requests 10000;

    location / {
        proxy_pass http://127.0.0.1:4200;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;

        # Synchronous video renders (audiogram / reel / slideshow) run well past
        # nginx's 60s default. Without this they are cut mid-render and reach
        # the user as a generic failure.
        proxy_read_timeout 300s;
        proxy_send_timeout 300s;
    }

    listen 443 ssl;                                    # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/app.sosyabot.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/app.sosyabot.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
}

nginx config is not in this repository

/etc/nginx lives on the host, outside version control, so nothing here can restore a vhost that gets overwritten. Keep the file in sites-available and enable it with a symlink (ln -s /etc/nginx/sites-available/<host> /etc/nginx/sites-enabled/) — that is the only copy Certbot, a vhost disable/enable cycle or a restore will preserve. A plain file dropped straight into sites-enabled is silently reverted to whatever sites-available holds the first time any of those happens.

Certbot ​

bash
sudo certbot --nginx -d app.sosyabot.com
sudo certbot --nginx -d sosyabot.com -d www.sosyabot.com
sudo certbot --nginx -d docs.sosyabot.com

Certbot writes the listen 443 ssl block, the if redirect block, and the certificate paths shown above. Renewal is on the system cron / systemd timer that Certbot installs.

Static-serve alternative for docs ​

The docs site is fully static after ./service.sh build. For a higher-throughput / lower-process-count deployment, point nginx directly at the dist directory and skip the Node vitepress preview process:

nginx
server {
    server_name docs.sosyabot.com;

    root /ssd/data/project/sosyabot/docs/content/.vitepress/dist;
    index index.html;

    location / {
        try_files $uri $uri.html $uri/ =404;
    }

    listen 443 ssl;
    ssl_certificate /etc/letsencrypt/live/docs.sosyabot.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/docs.sosyabot.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
}

If you take this path, drop the docs entry from COMPONENTS in service.sh so it isn't booted at ./service.sh start. The default ships with the preview process for parity with the landing component.

Logs ​

/var/log/nginx/access.log
/var/log/nginx/error.log

Per-vhost logging can be split via access_log and error_log directives inside each server block.

service.sh

ENV Reference

Backups