12c8615615
Adds accounting-service PATCH/archive, fiscal helpers, COA templates and setup status, plus SuperApp Accounting UI (DS, scoreboard, masters, vouchers, ledger, ops modules) with session refresh and HTTPS public API URLs. Co-authored-by: Cursor <cursoragent@cursor.com>
30 lines
1.2 KiB
Markdown
30 lines
1.2 KiB
Markdown
# SSL / TLS
|
|
|
|
## Edge Certificates
|
|
|
|
Nginx on `192.168.10.156` terminates TLS using Let's Encrypt material under `/etc/letsencrypt/live/torbatyar.ir/`.
|
|
|
|
Platform hosts force HTTP → HTTPS. ACME challenges stay on port 80 (`/.well-known/acme-challenge/`).
|
|
|
|
## Tenant Subdomain SSL
|
|
|
|
When a tenant domain is provisioned and `SSL_PROVISION_ENABLED=true`, Core Celery task SSHs to the Nginx host and runs `provision_ssl.py` to expand the certificate SAN list. Map file `torbatyar-tenant-ssl.map` marks hosts ready for HTTPS redirect.
|
|
|
|
Config keys: `SSL_PROVISION_HOST`, `SSL_PROVISION_USER`, `SSL_PROVISION_PASSWORD`, `SSL_PROVISION_SCRIPT`.
|
|
|
|
Scripts/configs:
|
|
|
|
- `infrastructure/nginx/provision_ssl.py`
|
|
- `infrastructure/nginx/torbatyar.ir.conf`
|
|
- `infrastructure/nginx/torbatyar-tenant-ssl.map`
|
|
|
|
## Custom Domains
|
|
|
|
Custom domains may be stored as `pending` until DNS verification ships. SSL automation for arbitrary custom domains follows the same expansion model once DNS points correctly.
|
|
|
|
## Related Documents
|
|
|
|
- [ADR-009](../architecture/adr/ADR-009.md)
|
|
- [Production](production.md)
|
|
- [Multi-Tenant Architecture](../architecture/multi-tenant-architecture.md)
|