deploy: production deployment for noema.dixon.cx

The systemd unit, nginx vhost, build-and-restart script and operator notes for running Noema as a Docker container behind nginx against the host PostgreSQL cluster. Secrets stay in /etc/noema/noema.env, outside the repo.
2026-10-10 23:30:35 +01:00
parent 9db3159c32
commit ada0b18b3f
4 changed files with 133 additions and 0 deletions
@@ -0,0 +1,29 @@
+# noema.dixon.cx -> Noema in Docker on 127.0.0.1:29630
+server {
+    listen 80;
+    listen [::]:80;
+    server_name noema.dixon.cx;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name noema.dixon.cx;
+
+    ssl_certificate     /etc/letsencrypt/live/noema.dixon.cx/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/noema.dixon.cx/privkey.pem;
+    include snippets/ssl-params.conf;
+
+    access_log /var/log/nginx/noema_access.log;
+    error_log  /var/log/nginx/noema_error.log;
+
+    client_max_body_size 2m;
+
+    location / {
+        proxy_pass http://127.0.0.1:29630;
+        include snippets/proxy.conf;
+        # SSE streams and model calls run long; don't buffer or cut them off.
+        proxy_buffering    off;
+        proxy_read_timeout 300s;
+    }
+}