12c8615615
Adds accounting-service PATCH/archive, fiscal helpers, COA templates and setup status, plus SuperApp Accounting UI (DS, scoreboard, masters, vouchers, ledger, ops modules) with session refresh and HTTPS public API URLs. Co-authored-by: Cursor <cursoragent@cursor.com>
41 lines
1.2 KiB
Markdown
41 lines
1.2 KiB
Markdown
# ADR-009: Nginx Edge with Automatic Tenant SSL Expansion
|
|
|
|
| Field | Value |
|
|
| --- | --- |
|
|
| Status | Accepted |
|
|
| Date | 2026-07-01 |
|
|
| Deciders | Platform Architecture + Ops |
|
|
| Supersedes | — |
|
|
| Superseded by | — |
|
|
|
|
## Context
|
|
|
|
Tenant subdomains (`*.torbatyar.ir`) and custom domains need HTTPS. Manual cert issuance does not scale with self-service onboarding.
|
|
|
|
## Decision
|
|
|
|
Nginx terminates TLS on the edge host. Let's Encrypt certificate for the platform is expanded for new tenant hostnames via `provision_ssl.py`, triggered by Core Celery over SSH when domains are provisioned. Map file `torbatyar-tenant-ssl.map` controls HTTPS redirect readiness per tenant host.
|
|
|
|
## Consequences
|
|
|
|
### Positive
|
|
|
|
- Self-service subdomain HTTPS
|
|
- Centralized edge routing for FE, Core, Identity, Keycloak
|
|
|
|
### Negative
|
|
|
|
- Worker must reach nginx host over SSH
|
|
- Cert expand rate limits and LE constraints apply
|
|
|
|
## Alternatives Considered
|
|
|
|
1. Traefik with built-in ACME
|
|
2. Cloudflare proxy-only TLS
|
|
|
|
## Related Documents
|
|
|
|
- [Deployment Architecture](../deployment-architecture.md)
|
|
- [SSL](../../deployment/ssl.md)
|
|
- [Production](../../deployment/production.md)
|