feat: nginx vhosts for OMNL production domains (omdnl.org + d-bis.org)

Co-authored-by: Cursor <cursoragent@cursor.com>

config/omnl-production-domains.v1.json

@@ -0,0 +1,53 @@
+{
+  "version": "1.0.0",
+  "originHost": "dev-bis-ali",
+  "originIp": "76.53.10.34",
+  "frontendPort": 3002,
+  "domains": [
+    {
+      "host": "exchange.omdnl.org",
+      "product": "dbis-trade",
+      "defaultRoute": "/trade"
+    },
+    {
+      "host": "exchange.d-bis.org",
+      "product": "dbis-trade",
+      "defaultRoute": "/trade"
+    },
+    {
+      "host": "secure.omdnl.org",
+      "product": "central-bank",
+      "defaultRoute": "/central-bank"
+    },
+    {
+      "host": "secure.d-bis.org",
+      "product": "central-bank",
+      "defaultRoute": "/central-bank"
+    },
+    {
+      "host": "online.omdnl.org",
+      "product": "online-banking",
+      "defaultRoute": "/central-bank"
+    },
+    {
+      "host": "forex.omdnl.org",
+      "product": "forex-trade",
+      "defaultRoute": "/trade"
+    },
+    {
+      "host": "forex.d-bis.org",
+      "product": "forex-trade",
+      "defaultRoute": "/trade"
+    },
+    {
+      "host": "digital.omdnl.org",
+      "product": "digital-swap",
+      "defaultRoute": "/swap"
+    },
+    {
+      "host": "office24.omnl.org",
+      "product": "office-24",
+      "defaultRoute": "/office-24"
+    }
+  ]
+}

deploy/nginx/omnl-common-locations.conf

@@ -0,0 +1,46 @@
+# Shared OMNL Bank proxy locations (include inside each server block)
+
+location /api/v1/ {
+    proxy_pass http://omnl_api/api/v1/;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_read_timeout 120s;
+}
+
+location /settlement/ {
+    proxy_pass http://omnl_settlement/api/v1/settlement/;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header Authorization $http_authorization;
+    proxy_read_timeout 120s;
+}
+
+location /exchange/ {
+    proxy_pass http://omnl_exchange/api/v1/exchange/;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_read_timeout 120s;
+}
+
+location /health {
+    return 200 'OMNL Bank online — 128 chains';
+    add_header Content-Type text/plain;
+}
+
+location / {
+    proxy_pass http://omnl_frontend;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+}

deploy/nginx/omnl-domains.conf

@@ -0,0 +1,115 @@
+# OMNL Bank — production domain routing
+# Deploy: scripts/deployment/deploy-omnl-domains.sh
+# Origin: dev-bis-ali (76.53.10.34) — point DNS A records here (or Cloudflare proxy)
+
+upstream omnl_frontend {
+    server 127.0.0.1:3002;
+}
+
+upstream omnl_api {
+    server 127.0.0.1:3000;
+}
+
+upstream omnl_settlement {
+    server 127.0.0.1:3011;
+}
+
+upstream omnl_exchange {
+    server 127.0.0.1:3012;
+}
+
+# DBIS Trade — exchange.omdnl.org + exchange.d-bis.org
+server {
+    listen 80;
+    listen [::]:80;
+    server_name exchange.omdnl.org exchange.d-bis.org;
+
+    add_header X-OMNL-Product "dbis-trade" always;
+    add_header X-OMNL-Chains "128" always;
+
+    location = / {
+        return 302 /trade;
+    }
+
+    include /etc/nginx/snippets/omnl-common-locations.conf;
+}
+
+# Central Bank secure dashboard — secure.omdnl.org + secure.d-bis.org
+server {
+    listen 80;
+    listen [::]:80;
+    server_name secure.omdnl.org secure.d-bis.org;
+
+    add_header X-OMNL-Product "central-bank" always;
+    add_header X-OMNL-Chains "128" always;
+
+    location = / {
+        return 302 /central-bank;
+    }
+
+    include /etc/nginx/snippets/omnl-common-locations.conf;
+}
+
+# OMNL online banking hub — online.omdnl.org
+server {
+    listen 80;
+    listen [::]:80;
+    server_name online.omdnl.org;
+
+    add_header X-OMNL-Product "online-banking" always;
+    add_header X-OMNL-Chains "128" always;
+
+    location = / {
+        return 302 /central-bank;
+    }
+
+    include /etc/nginx/snippets/omnl-common-locations.conf;
+}
+
+# Forex terminal — forex.omdnl.org + forex.d-bis.org
+server {
+    listen 80;
+    listen [::]:80;
+    server_name forex.omdnl.org forex.d-bis.org;
+
+    add_header X-OMNL-Product "forex-trade" always;
+    add_header X-OMNL-Chains "128" always;
+
+    location = / {
+        return 302 /trade;
+    }
+
+    include /etc/nginx/snippets/omnl-common-locations.conf;
+}
+
+# Digital assets / swap — digital.omdnl.org
+server {
+    listen 80;
+    listen [::]:80;
+    server_name digital.omdnl.org;
+
+    add_header X-OMNL-Product "digital-swap" always;
+    add_header X-OMNL-Chains "128" always;
+
+    location = / {
+        return 302 /swap;
+    }
+
+    include /etc/nginx/snippets/omnl-common-locations.conf;
+}
+
+# Office 24 settlement — office24.omnl.org
+server {
+    listen 80;
+    listen [::]:80;
+    server_name office24.omnl.org;
+
+    add_header X-OMNL-Product "office-24" always;
+    add_header X-OMNL-Chains "128" always;
+
+    location = / {
+        return 302 /office-24;
+    }
+
+    include /etc/nginx/snippets/omnl-common-locations.conf;
+}

scripts/deployment/deploy-omnl-domains.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# Install nginx vhosts for OMNL production domains
+set -euo pipefail
+
+REPO_DIR="${OMNL_BANK_ROOT:-$HOME/smom-dbis-138}"
+SNIPPET_SRC="$REPO_DIR/deploy/nginx/omnl-common-locations.conf"
+VHOST_SRC="$REPO_DIR/deploy/nginx/omnl-domains.conf"
+SNIPPET_DST="/etc/nginx/snippets/omnl-common-locations.conf"
+VHOST_DST="/etc/nginx/sites-available/omnl-domains"
+VHOST_LINK="/etc/nginx/sites-enabled/omnl-domains"
+
+log() { echo "[$(date -Iseconds)] $*"; }
+
+if [ ! -f "$SNIPPET_SRC" ] || [ ! -f "$VHOST_SRC" ]; then
+  echo "Missing nginx configs under $REPO_DIR/deploy/nginx" >&2
+  exit 1
+fi
+
+log "Installing nginx snippet + vhosts..."
+sudo mkdir -p /etc/nginx/snippets
+sudo cp "$SNIPPET_SRC" "$SNIPPET_DST"
+sudo cp "$VHOST_SRC" "$VHOST_DST"
+sudo ln -sf "$VHOST_DST" "$VHOST_LINK"
+
+log "Testing nginx configuration..."
+sudo nginx -t
+
+log "Reloading nginx..."
+sudo systemctl reload nginx
+
+log "Verifying local routes (Host header)..."
+check_host() {
+  local host="$1"
+  local expect="$2"
+  local code
+  code=$(curl -s -o /dev/null -w '%{http_code}' -H "Host: $host" "http://127.0.0.1/")
+  log "  $host -> HTTP $code (expect redirect to $expect)"
+}
+
+check_host exchange.omdnl.org /trade
+check_host secure.d-bis.org /central-bank
+check_host office24.omnl.org /office-24
+check_host digital.omdnl.org /swap
+
+log "OMNL domain deploy complete"
+log "DNS: point all domains A record to 76.53.10.34 (or Cloudflare proxy to origin)"