# Online Nginx Rules

This directory is for production-facing nginx contract notes.

Current rules:

1. production serves the frontend from `/`
2. nginx proxies `/services`, `/api`, `/product`, `/webhooks`, `/health`, and `/ws` to the env backend port
3. nginx must pin `X-Forwarded-Proto` to `https`
4. frontend root and all parent directories must stay readable and traversable by the nginx service user

Minimum production verification:

1. `curl -isk https://nexuscrm-new-prod.pingcap.com/health`
2. `curl -isk https://nexuscrm-new-prod.pingcap.com/`
3. `curl -isk https://nexuscrm-new-prod.pingcap.com/index.html`
4. verify `POST /services/oauth2/token` returns `200`
5. verify token `instance_url` and `id` remain on `https://nexuscrm-new-prod.pingcap.com`