Mortezakoohjani 12c8615615 Ship enterprise Accounting FE/API with CRUD parity and production wiring.

Adds accounting-service PATCH/archive, fiscal helpers, COA templates and setup status, plus SuperApp Accounting UI (DS, scoreboard, masters, vouchers, ledger, ops modules) with session refresh and HTTPS public API URLs.

Co-authored-by: Cursor <cursoragent@cursor.com>

2026-07-24 15:26:43 +03:30

1.2 KiB

Raw Blame History

ADR-009: Nginx Edge with Automatic Tenant SSL Expansion

Field	Value
Status	Accepted
Date	2026-07-01
Deciders	Platform Architecture + Ops
Supersedes	—
Superseded by	—

Context

Tenant subdomains (*.torbatyar.ir) and custom domains need HTTPS. Manual cert issuance does not scale with self-service onboarding.

Decision

Nginx terminates TLS on the edge host. Let's Encrypt certificate for the platform is expanded for new tenant hostnames via provision_ssl.py, triggered by Core Celery over SSH when domains are provisioned. Map file torbatyar-tenant-ssl.map controls HTTPS redirect readiness per tenant host.

Consequences

Positive

Self-service subdomain HTTPS
Centralized edge routing for FE, Core, Identity, Keycloak

Negative

Worker must reach nginx host over SSH
Cert expand rate limits and LE constraints apply

Alternatives Considered

Traefik with built-in ACME
Cloudflare proxy-only TLS

1.2 KiB Raw Blame History