initial snapshot: nginx + docker-compose configs

.gitignore

@@ -0,0 +1,5 @@
+# No data dirs, no secrets
+*.pem
+*.key
+.env
+*_secret*

README.md

@@ -0,0 +1,14 @@
+# hetzner infra
+
+Server: aksara (Hetzner)
+IP: 62.238.100.84
+
+## Services
+- Open WebUI → https://ai.zidanesyukri.me
+- n8n → https://n8n.zidanesyukri.me
+- Gitea → https://gitea.zidanesyukri.me
+- aksara.ink → /var/www/aksara.ink (PHP)
+
+## Structure
+- `nginx/` — all vhost configs
+- `services/` — docker-compose files per service

nginx/ai.zidanesyukri.me

@@ -0,0 +1,39 @@
+server {
+    listen 80;
+    server_name ai.zidanesyukri.me;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl;
+    server_name ai.zidanesyukri.me;
+
+    ssl_certificate /etc/letsencrypt/live/ai.zidanesyukri.me/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/ai.zidanesyukri.me/privkey.pem;
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+    location / {
+        proxy_pass http://localhost:8080;
+        proxy_http_version 1.1;
+        
+        # WebSocket & Connection Upgrades
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        
+        # Standard Proxy Headers
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # Disable Buffering for Real-time AI Streaming
+        proxy_buffering off;
+        proxy_cache off;
+        
+        # Extended Timeouts for Long AI Inferences
+        proxy_read_timeout 86400;
+        proxy_send_timeout 86400;
+        proxy_connect_timeout 300;
+    }
+}

nginx/aksara.ink

@@ -0,0 +1,45 @@
+server {
+
+    server_name aksara.ink www.aksara.ink;
+    root /var/www/aksara.ink;
+    index index.php index.html;
+
+    location / {
+        try_files $uri $uri/ =404;
+    }
+
+    location ~ \.php$ {
+        include snippets/fastcgi-php.conf;
+        fastcgi_pass unix:/run/php/php8.5-fpm.sock;
+    }
+
+    listen [::]:443 ssl ipv6only=on; # managed by Certbot
+    listen 443 ssl; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/aksara.ink/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/aksara.ink/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+
+}
+server {
+    if ($host = www.aksara.ink) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    if ($host = aksara.ink) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    listen 80;
+    listen [::]:80;
+
+    server_name aksara.ink www.aksara.ink;
+    return 404; # managed by Certbot
+
+
+
+
+}

nginx/drop-ip

@@ -0,0 +1,6 @@
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    server_name _;
+    return 444;
+}

nginx/gitea.zidanesyukri.me

@@ -0,0 +1,25 @@
+server {
+    server_name gitea.zidanesyukri.me;
+    location / {
+        proxy_pass http://localhost:3000;
+    }
+
+    listen 443 ssl; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/gitea.zidanesyukri.me/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/gitea.zidanesyukri.me/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+}
+server {
+    if ($host = gitea.zidanesyukri.me) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    listen 80;
+    server_name gitea.zidanesyukri.me;
+    return 404; # managed by Certbot
+
+
+}

nginx/n8n.zidanesyukri.me

@@ -0,0 +1,25 @@
+server {
+    server_name n8n.zidanesyukri.me;
+    location / {
+        proxy_pass http://localhost:5678;
+    }
+
+    listen 443 ssl; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/n8n.zidanesyukri.me/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/n8n.zidanesyukri.me/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+}
+server {
+    if ($host = n8n.zidanesyukri.me) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    listen 80;
+    server_name n8n.zidanesyukri.me;
+    return 404; # managed by Certbot
+
+
+}

nginx/zidanesyukri.me

@@ -0,0 +1,19 @@
+server {
+    listen 80;
+    server_name zidanesyukri.me;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl;
+    server_name zidanesyukri.me;
+
+    ssl_certificate /etc/letsencrypt/live/zidanesyukri.me-0001/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/zidanesyukri.me-0001/privkey.pem;
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+    # Placeholder — to be decided
+    return 200 "coming soon";
+    add_header Content-Type text/plain;
+}

services/gitea/docker-compose.yml

@@ -0,0 +1,17 @@
+services:
+  server:
+    image: gitea/gitea:latest
+    container_name: gitea
+    environment:
+      - USER_UID=1000
+      - USER_GID=1000
+      - GITEA__server__ROOT_URL=https://gitea.zidanesyukri.me/
+      - GITEA__server__DOMAIN=gitea.zidanesyukri.me
+    restart: always
+    volumes:
+      - ./data:/data
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+    ports:
+      - "3000:3000"
+      - "222:22"

services/n8n/docker-compose.yml

@@ -0,0 +1,15 @@
+services:
+  n8n:
+    image: docker.n8n.io/n8nio/n8n
+    container_name: n8n
+    restart: unless-stopped
+    ports:
+      - "5678:5678"
+    environment:
+      - N8N_HOST=n8n.zidanesyukri.me
+      - N8N_PORT=5678
+      - N8N_PROTOCOL=https
+      - NODE_ENV=production
+      - WEBHOOK_URL=https://n8n.zidanesyukri.me/
+    volumes:
+      - ./data:/home/node/.n8n

services/openwebui/docker-compose.yml

@@ -0,0 +1,12 @@
+services:
+  open-webui:
+    image: ghcr.io/open-webui/open-webui:main
+    container_name: open-webui
+    restart: unless-stopped
+    ports:
+      - "8080:8080"
+    environment:
+      - WEBUI_URL=https://ai.zidanesyukri.me
+      - CORS_ALLOW_ORIGIN=https://ai.zidanesyukri.me
+    volumes:
+      - ./data:/app/backend/data