Author	SHA1	Message	Date
Paul Schneider	daf5949392	contrib: gate QUIC reuseport on production + Org only ... reuseport is legal only once per addr:port (443/udp). preprod and prod share the same IP today, so enabling it on preprod-Org clashed with prod-Org and made nginx refuse the config. QUIC_OPTS now resolves to " reuseport" only when APP_INSTALL_ENV=production AND the host is Org; preprod and the Api/Blogs vhosts get a plain `listen 443 quic;`. Also drop the stray space before `;` when QUIC_OPTS is empty by moving the separator into the QUIC_OPTS value (`listen 443 quic$QUIC_OPTS;`). Co-Authored-By: Claude Code <noreply@anthropic.com>	2026-09-25 18:32:44 +01:00
Paul Schneider	5553f2f290	Génération contrib : vhosts nginx h3 edge + appsettings (jq) + QUIC logiciel Kestrel ... Vhosts nginx (contrib/template.vhost + Makefile, envsubst allowlist) : HTTP/3 edge per contrib/quic.md — listen 443 quic reuseport (Org only), http2/http3 on, Alt-Svc, ssl_protocols TLSv1.3. Cibles generate-nginx / generate-nginx-prod -> generated/nginx/ (gitignoré). Allowlist préserve les variables nginx intrinsèques ($host, $scheme, ...). Appsettings (contrib/template.appsettings-{org,api,blogs}.json + Makefile) : génération via jq (et non envsubst) car le mot de passe SMTP contient un qui cassait le JSON. Substitue $DOMAIN (DOMAIN_ROOT) partout et injecte $SMTP_PASSWORD depuis env (échappement JSON, secret non exposé en cmd). Cible generate-appsettings -> generated/appsettings/. QUIC logiciel : Kestrel:Endpoints:Https:Protocols = Http1AndHttp2AndHttp3 sur les 3 templates appsettings (capacité, non joignable derrière nginx). Fix bonus : générateur systemd HTTP_PORT"$($*_PORT)" (était "$*_$(HTTP_PORT)" -> port vide localhost:Org_). Runbook contrib/README.nginx.md. Prérequis host : nginx http_v3_module, UDP 443, libmsquic (Kestrel h3). Co-Authored-By: Claude Code <noreply@anthropic.com>	2026-09-25 13:31:56 +01:00
Paul Schneider	3fe7b8b46c	templates for appsettings	2026-09-25 13:27:00 +01:00