From 8ab2598c1dd2128a23a6b9e5a63a9966397ef67c Mon Sep 17 00:00:00 2001
From: Basil Bruhn <basil.bruhn@psi.ch>
Date: Mon, 10 Mar 2025 09:52:14 +0100
Subject: [PATCH] initial commit MCDA

---
 conf.d/mcda-calculator.conf | 21 +++++++++++++++++++++
 docker-compose.yaml         | 29 +++++++++++++++++++++++++++++
 nginx.conf                  | 29 +++++++++++++++++++++++++++++
 3 files changed, 79 insertions(+)
 create mode 100644 conf.d/mcda-calculator.conf
 create mode 100644 docker-compose.yaml
 create mode 100644 nginx.conf

diff --git a/conf.d/mcda-calculator.conf b/conf.d/mcda-calculator.conf
new file mode 100644
index 0000000..cc052a0
--- /dev/null
+++ b/conf.d/mcda-calculator.conf
@@ -0,0 +1,21 @@
+server {
+    listen 80;
+    server_name mcda-calculator.psi.ch;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl;
+    server_name mcda-calculator.psi.ch;
+
+    ssl_certificate /etc/nginx/certs/lx-docker-dmz-01.psi.ch.crt;
+    ssl_certificate_key /etc/nginx/private/lx-docker-dmz-01.psi.ch.key;
+
+    location / {
+        proxy_pass http://mcda-calculator:8050;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
diff --git a/docker-compose.yaml b/docker-compose.yaml
new file mode 100644
index 0000000..53bef24
--- /dev/null
+++ b/docker-compose.yaml
@@ -0,0 +1,29 @@
+services:
+# linux-eng@psi.ch
+  nginx:
+    image: gitea.psi.ch/images/nginx:1.27.4
+    container_name: nginx_proxy
+    restart: always
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - /etc/pki/tls/certs:/etc/nginx/certs:ro
+      - /etc/pki/tls/private:/etc/nginx/private:ro
+      - /etc/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
+      - /etc/nginx/conf.d:/etc/nginx/conf.d:ro
+    networks:
+      - public
+      - backend
+ 
+# Huang He <river.huang@psi.ch>
+  mcda-calculator:
+    image: gitea.psi.ch/images/mcda-calculator:latest
+    container_name: mcda-calculator
+    restart: always
+    networks: 
+      - backend
+
+networks:
+  public:
+  backend:
diff --git a/nginx.conf b/nginx.conf
new file mode 100644
index 0000000..c23589f
--- /dev/null
+++ b/nginx.conf
@@ -0,0 +1,29 @@
+user  nginx;
+worker_processes  auto;
+pid /run/nginx.pid;
+include /etc/nginx/modules-enabled/*.conf;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+
+    add_header X-Content-Type-Options nosniff;
+    add_header X-Frame-Options DENY;
+    add_header X-XSS-Protection "1; mode=block";
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    add_header Referrer-Policy no-referrer-when-downgrade;
+
+    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                      '$status $body_bytes_sent "$http_referer" '
+                      '"$http_user_agent" "$http_x_forwarded_for"';
+
+    access_log  /var/log/nginx/access.log  main;
+
+    sendfile        on;
+    keepalive_timeout  65;
+    include /etc/nginx/conf.d/*.conf;
+}