# ADR-009: Nginx Edge with Automatic Tenant SSL Expansion

| Field | Value |
| --- | --- |
| Status | Accepted |
| Date | 2026-07-01 |
| Deciders | Platform Architecture + Ops |
| Supersedes | — |
| Superseded by | — |

## Context

Tenant subdomains (`*.torbatyar.ir`) and custom domains need HTTPS. Manual cert issuance does not scale with self-service onboarding.

## Decision

Nginx terminates TLS on the edge host. Let's Encrypt certificate for the platform is expanded for new tenant hostnames via `provision_ssl.py`, triggered by Core Celery over SSH when domains are provisioned. Map file `torbatyar-tenant-ssl.map` controls HTTPS redirect readiness per tenant host.

## Consequences

### Positive

- Self-service subdomain HTTPS
- Centralized edge routing for FE, Core, Identity, Keycloak

### Negative

- Worker must reach nginx host over SSH
- Cert expand rate limits and LE constraints apply

## Alternatives Considered

1. Traefik with built-in ACME
2. Cloudflare proxy-only TLS

## Related Documents

- [Deployment Architecture](../deployment-architecture.md)
- [SSL](../../deployment/ssl.md)
- [Production](../../deployment/production.md)