dev2: track the gateway.c0mpute.com vhost; /git/ goes to vienna

dev2/c0mpute-gateway/README.md

@@ -19,4 +19,16 @@ config edit: `ssh root@dev2.profullstack.com systemctl restart c0mpute-worker`.
 purpose for longer than a minute, stop the timer too:
 `systemctl stop c0mpute-gateway-watchdog.timer c0mpute-worker`.
 
+## nginx: `gateway.c0mpute.com`
+
+`nginx-gateway.c0mpute.com.conf` is the vhost (TLS on `127.0.0.1:8444` behind the
+proxy-protocol listener). Everything goes to the local worker on `:7777` **except
+`/git/`**, which goes to vienna (`http://dev.chovy.com:7777`, node AmaKBdpB, 2900 GiB
+hosting budget). dev2's disk is full, so its own node's automatic hosting budget is 0
+and it refused every `git push` with 507; a gateway has to hold a pushed repo before the
+network copies it. Pushes are owner-signed and every file is hash-checked by the client,
+so the plain-HTTP hop to vienna does not weaken them. `/git/` allows 1100 MB bodies (the
+repo size limit plus headroom). If vienna goes away, point that block at another node
+with room (seed1's :7777 is firewalled from outside).
+
 Install / update: `scp -r dev2/c0mpute-gateway root@dev2.profullstack.com:/root/ && ssh root@dev2.profullstack.com /root/c0mpute-gateway/install.sh`

dev2/c0mpute-gateway/install.sh

@@ -9,6 +9,9 @@ install -m 0644 c0mpute-gateway-watchdog.service c0mpute-gateway-watchdog.timer
 install -d /etc/systemd/system/c0mpute-worker.service.d /etc/systemd/system/moshpit-c0mpute-edge.service.d
 install -m 0644 c0mpute-worker.service.d-resilient.conf /etc/systemd/system/c0mpute-worker.service.d/resilient.conf
 install -m 0644 moshpit-c0mpute-edge.service.d-perms.conf /etc/systemd/system/moshpit-c0mpute-edge.service.d/perms.conf
+install -m 0644 nginx-gateway.c0mpute.com.conf /etc/nginx/sites-available/gateway.c0mpute.com
+ln -sf /etc/nginx/sites-available/gateway.c0mpute.com /etc/nginx/sites-enabled/gateway.c0mpute.com
+nginx -t && systemctl reload nginx
 systemctl daemon-reload
 systemctl enable --now c0mpute-gateway-watchdog.timer
 systemctl show c0mpute-worker -p Restart -p StartLimitIntervalUSec

dev2/c0mpute-gateway/nginx-gateway.c0mpute.com.conf

@@ -0,0 +1,52 @@
+# c0mpute gateway for dev2 worker (:7777): hosting sites (/s/<site_id>/), storage, opendisk.
+# Announced as gateway.announce so the Moshpit edge and d1sks can reach it. 2026-11-09 riotcoder
+server {
+    listen 80;
+    listen [::]:80;
+    server_name gateway.c0mpute.com;
+    location ^~ /.well-known/acme-challenge/ {
+        root /var/www/acme;
+        default_type "text/plain";
+    }
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+server {
+    listen 127.0.0.1:8444 ssl proxy_protocol;
+    http2 on;
+    server_name gateway.c0mpute.com;
+    ssl_certificate     /etc/nginx/ssl/gateway.c0mpute.com/fullchain.pem;
+    ssl_certificate_key /etc/nginx/ssl/gateway.c0mpute.com/privkey.pem;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers off;
+    client_max_body_size 64m;
+    # Git hosting goes to vienna (node AmaKBdpB, 2900 GiB budget): the dev2 disk
+    # is full, so the dev2 node refuses pushes (507). Pushes are owner-signed and
+    # hash-checked end to end, so the plain-HTTP hop does not weaken them.
+    # 2026-11-09 riotcoder
+    location ^~ /git/ {
+        client_max_body_size 1100m;
+        proxy_pass http://dev.chovy.com:7777;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_connect_timeout 10s;
+        proxy_read_timeout 600s;
+        proxy_send_timeout 600s;
+        proxy_buffering off;
+        proxy_request_buffering off;
+    }
+    location / {
+        proxy_pass http://127.0.0.1:7777;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_read_timeout 300s;
+        proxy_buffering off;
+    }
+}