Resolve Concelier/Excititor merge conflicts

deploy/compose/mirror-gateway/README.md

@@ -0,0 +1,13 @@
+# Mirror Gateway Assets
+
+This directory holds the reverse-proxy configuration and TLS material for the managed
+mirror profile:
+
+- `conf.d/*.conf` – nginx configuration shipped with the profile.
+- `tls/` – place environment-specific certificates and private keys
+  (`mirror-primary.{crt,key}`, `mirror-community.{crt,key}`, etc.).
+- `secrets/` – populate Basic Auth credential stores (`*.htpasswd`) that gate each
+  mirror domain. Generate with `htpasswd -B`.
+
+The Compose bundle mounts these paths read-only. Populate `tls/` with the actual
+certificates before invoking `docker compose config` or `docker compose up`.

deploy/compose/mirror-gateway/conf.d/mirror-locations.conf

@@ -0,0 +1,44 @@
+proxy_set_header Host              $host;
+proxy_set_header X-Real-IP         $remote_addr;
+proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+proxy_set_header X-Forwarded-Proto $scheme;
+proxy_redirect                     off;
+
+add_header X-Cache-Status $upstream_cache_status always;
+
+location = /healthz {
+    default_type application/json;
+    return 200 '{"status":"ok"}';
+}
+
+location /concelier/exports/ {
+    proxy_pass http://concelier_backend/concelier/exports/;
+    proxy_cache mirror_cache;
+    proxy_cache_key $mirror_cache_key;
+    proxy_cache_valid 200 5m;
+    proxy_cache_valid 404 1m;
+    add_header Cache-Control "public, max-age=300, immutable" always;
+}
+
+location /concelier/ {
+    proxy_pass http://concelier_backend/concelier/;
+    proxy_cache off;
+}
+
+location /excititor/mirror/ {
+    proxy_pass http://excititor_backend/excititor/mirror/;
+    proxy_cache mirror_cache;
+    proxy_cache_key $mirror_cache_key;
+    proxy_cache_valid 200 5m;
+    proxy_cache_valid 404 1m;
+    add_header Cache-Control "public, max-age=300, immutable" always;
+}
+
+location /excititor/ {
+    proxy_pass http://excititor_backend/excititor/;
+    proxy_cache off;
+}
+
+location / {
+    return 404;
+}

deploy/compose/mirror-gateway/conf.d/mirror.conf

@@ -0,0 +1,51 @@
+proxy_cache_path /var/cache/nginx/mirror levels=1:2 keys_zone=mirror_cache:100m max_size=10g inactive=12h use_temp_path=off;
+
+map $request_uri $mirror_cache_key {
+    default $scheme$request_method$host$request_uri;
+}
+
+upstream concelier_backend {
+    server concelier:8445;
+    keepalive 32;
+}
+
+upstream excititor_backend {
+    server excititor:8448;
+    keepalive 32;
+}
+
+server {
+    listen 80;
+    server_name _;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name mirror-primary.stella-ops.org;
+
+    ssl_certificate     /etc/nginx/tls/mirror-primary.crt;
+    ssl_certificate_key /etc/nginx/tls/mirror-primary.key;
+    ssl_protocols       TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+
+    auth_basic "StellaOps Mirror – primary";
+    auth_basic_user_file /etc/nginx/secrets/mirror-primary.htpasswd;
+
+    include /etc/nginx/conf.d/mirror-locations.conf;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name mirror-community.stella-ops.org;
+
+    ssl_certificate     /etc/nginx/tls/mirror-community.crt;
+    ssl_certificate_key /etc/nginx/tls/mirror-community.key;
+    ssl_protocols       TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+
+    auth_basic "StellaOps Mirror – community";
+    auth_basic_user_file /etc/nginx/secrets/mirror-community.htpasswd;
+
+    include /etc/nginx/conf.d/mirror-locations.conf;
+}