fix (infra): separate S3 into web and api domains

proxy/nginx/conf.d/s3-api.conf

@@ -1,4 +1,5 @@
 # HTTP configuration
+
 # -- Redirect all HTTP requests to HTTPS port
 server {
 	listen 80; # HTTP port
@@ -12,7 +13,7 @@ server {
 
 server {
 	listen 443 ssl;
-	server_name *.s3.systemsobscure.net s3.systemsobscure.net;
+	server_name s3.systemsobscure.net;
 
   client_max_body_size 100M; # Allow large image uploads
 
@@ -26,7 +27,7 @@ server {
 
 	# S3 API for authenticated operations 
 	
-	location /api/ {
+	location / {
 		proxy_pass http://172.18.0.1:3900/;
 		proxy_set_header Host $host;
 	
@@ -40,15 +41,4 @@ server {
 			return 204;
     }
 	}
-
-
-	# Web endpoint for public file access 
-
-	location / {
-		proxy_pass http://172.18.0.1:3902;
-		proxy_set_header Host $host;
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Proto $scheme;
-  }
 }

proxy/nginx/conf.d/s3-web.conf

@@ -0,0 +1,36 @@
+
+# S3 (Garage) Web endpoint for public file access 
+
+# HTTP configuration
+# -- Redirect all HTTP requests to HTTPS port
+server {
+	listen 80; # HTTP port
+	server_name s3.systemsobscure.net;
+	location / {
+		return 301 https://$host$request_uri; # Variable is a placeholder for all requests to the server name
+	}
+}
+
+# HTTPS configuration 
+
+server {
+	listen 443 ssl;
+	server_name *.s3.systemsobscure.net;
+
+	# SSL configuration
+	ssl_certificate /etc/letsencrypt/live/systemsobscure.net/fullchain.pem;
+	ssl_certificate_key /etc/letsencrypt/live/systemsobscure.net/privkey.pem;
+
+	# Security headers
+  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    
+
+
+	location / {
+		proxy_pass http://172.18.0.1:3902;
+		proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+  }
+}