From 20b6fc86ce3bea607f98f6302976e6fe60ba4b6d Mon Sep 17 00:00:00 2001
From: CarterPerez-dev <cartertechsolution@gmail.com>
Date: Sun, 17 May 2026 19:07:32 -0400
Subject: [PATCH] fix(canary): prod nginx proxy_pass /api/, /c/, /k/ to canary
 upstream

Audit F1: prod.nginx had only the SPA fallback so all API requests, trigger
requests, and kubeconfig requests returned index.html, breaking the prod
deployment end-to-end. Added an upstream canary block to nginx.prod.conf and
three proxy_pass location blocks mirroring dev.nginx (plus CF-Connecting-IP
header since prod sits behind Cloudflare Tunnel).
---
 .../infra/nginx/nginx.prod.conf               |  5 +++
 .../infra/nginx/prod.nginx                    | 34 +++++++++++++++++++
 2 files changed, 39 insertions(+)

diff --git a/PROJECTS/beginner/canary-token-generator/infra/nginx/nginx.prod.conf b/PROJECTS/beginner/canary-token-generator/infra/nginx/nginx.prod.conf
index 0bedf916..506cb8ef 100644
--- a/PROJECTS/beginner/canary-token-generator/infra/nginx/nginx.prod.conf
+++ b/PROJECTS/beginner/canary-token-generator/infra/nginx/nginx.prod.conf
@@ -18,6 +18,11 @@ http {
     include /etc/nginx/mime.types;
     default_type application/octet-stream;
 
+    upstream canary {
+        server canary:8080;
+        keepalive 16;
+    }
+
     limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;
     limit_conn_zone $binary_remote_addr zone=conn_limit:10m;
     limit_req_status 429;
diff --git a/PROJECTS/beginner/canary-token-generator/infra/nginx/prod.nginx b/PROJECTS/beginner/canary-token-generator/infra/nginx/prod.nginx
index 29db53b0..5de1926a 100644
--- a/PROJECTS/beginner/canary-token-generator/infra/nginx/prod.nginx
+++ b/PROJECTS/beginner/canary-token-generator/infra/nginx/prod.nginx
@@ -28,6 +28,40 @@ server {
         add_header Content-Type text/plain;
     }
 
+    location /api/ {
+        proxy_pass http://canary;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header CF-Connecting-IP $http_cf_connecting_ip;
+        proxy_read_timeout 30s;
+        limit_req zone=api_limit burst=20 nodelay;
+    }
+
+    location /c/ {
+        proxy_pass http://canary;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header CF-Connecting-IP $http_cf_connecting_ip;
+        proxy_read_timeout 30s;
+    }
+
+    location /k/ {
+        proxy_pass http://canary;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header CF-Connecting-IP $http_cf_connecting_ip;
+        proxy_read_timeout 30s;
+    }
+
     location /assets/ {
         expires 1y;
         add_header Cache-Control "public, immutable";