Merge pull request '[infra] 서버 도메인 설정 변경 및 SSL(HTTPS) 적용' (#12) from codex/taxbaik-wasm-theme into master

Reviewed-on: #12

CLAUDE.md

@@ -1628,7 +1628,7 @@ curl http://127.0.0.1/taxbaik/admin/login
 ### E2E 테스트 & 반응형 검증
 ```bash
 # 문의 폼 제출
-curl -X POST http://178.104.200.7/taxbaik/contact \
+curl -X POST http://taxbaik.com/taxbaik/contact \
   -d "name=테스트&phone=010-1234-5678&service_type=사업자세무&message=테스트"
 
 # 관리자 DB에서 확인
@@ -1667,7 +1667,7 @@ npx playwright test admin-responsive.spec.ts --project="Desktop Chrome"
 
 **프로덕션 E2E 테스트**:
 ```bash
-export E2E_BASE_URL="http://178.104.200.7/taxbaik"
+export E2E_BASE_URL="http://taxbaik.com/taxbaik"
 export E2E_ADMIN_USERNAME="test_admin"
 export E2E_ADMIN_PASSWORD="TestAdmin@123456"
 
@@ -1935,7 +1935,7 @@ else
 2. **Actions run 생성 확인**
    ```powershell
    $headers = @{ Authorization = "token $env:GITEA_TOKEN_TAXBAIK" }
-   $runs = Invoke-RestMethod -Headers $headers -Uri "http://178.104.200.7/api/v1/repos/kjh2064/taxbaik/actions/runs?limit=10"
+   $runs = Invoke-RestMethod -Headers $headers -Uri "http://gitea.taxbaik.com/api/v1/repos/kjh2064/taxbaik/actions/runs?limit=10"
    $runs.workflow_runs | Select-Object id,path,event,head_sha,display_title,status,conclusion
    ```
    `deploy.yml@refs/heads/master`, `event=push`, 최신 `head_sha`가 있어야 배포가 실제로 시작된 것이다.

CLOUD_SERVER_SETUP.md

@@ -17,7 +17,7 @@
 | 3.3 | [주요 Python 패키지](#33-주요-python-패키지-시스템) | 시스템/venv 패키지 구분 |
 | 4 | [서비스 아키텍처](#4-서비스-아키텍처) | 포트 맵, Nginx 리버스 프록시 |
 | 4.1 | [포트 맵](#41-포트-맵) | 22, 80, 2222, 3000, 5000, 5432 |
-| 4.2 | [Nginx 리버스 프록시](#42-nginx-리버스-프록시) | `/` → Gitea, `/quant/` → Blazor |
+| 4.2 | [Nginx 리버스 프록시](#42-nginx-리버스-프록시) | 도메인 기반 가상 호스트 분기 (홈페이지, Gitea, Quant) |
 | 5 | [Gitea](#5-gitea) | Docker Compose 설정, 시크릿, 데이터 경로 |
 | 5.1 | [Docker Compose](#51-docker-compose) | `gitea:1.26.4`, PG 연동 |
 | 5.2 | [시크릿 관리](#52-시크릿-관리) | `/opt/stacks/gitea/.env` |
@@ -126,17 +126,17 @@ boto3, cryptography, Jinja2, jsonschema, fail2ban 등 시스템 레벨로 설치
 ### 4.2. Nginx 리버스 프록시
 
 ```nginx
-# /etc/nginx/sites-enabled/gitea-ip.conf
+# /etc/nginx/sites-available/taxbaik-domains.conf
 
+# 1. TaxBaik 홈페이지 (taxbaik.com, www.taxbaik.com)
 server {
-    listen 80 default_server;
+    listen 80;
-    listen [::]:80 default_server;
+    server_name taxbaik.com www.taxbaik.com;
-    server_name _;
     client_max_body_size 512M;
 
-    # QuantEngine Blazor Web App
+    # 루트 경로 요청을 /taxbaik 으로 프록싱하여 base href /taxbaik/ 에 대응
-    location /quant/ {
+    location / {
-        proxy_pass http://127.0.0.1:5000/;
+        proxy_pass http://127.0.0.1:5001/taxbaik/;
         proxy_http_version 1.1;
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection "Upgrade";
@@ -147,7 +147,26 @@ server {
         proxy_set_header X-Forwarded-Proto $scheme;
     }
 
-    # Gitea (기본)
+    # /taxbaik/ 하위로 들어오는 리소스 및 페이지 요청 처리
+    location /taxbaik {
+        proxy_pass http://127.0.0.1:5001;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "Upgrade";
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 120s;
+    }
+}
+
+# 2. Gitea (gitea.taxbaik.com)
+server {
+    listen 80;
+    server_name gitea.taxbaik.com;
+    client_max_body_size 512M;
+
     location / {
         proxy_pass http://127.0.0.1:3000;
         proxy_http_version 1.1;
@@ -160,12 +179,31 @@ server {
         proxy_send_timeout 300;
     }
 }
+
+# 3. QuantEngine (quant.taxbaik.com)
+server {
+    listen 80;
+    server_name quant.taxbaik.com;
+
+    location / {
+        proxy_pass http://127.0.0.1:5000/;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "Upgrade";
+        proxy_set_header Host $host;
+        proxy_cache_bypass $http_upgrade;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
 ```
 
 **라우팅 요약**:
-- `http://178.104.200.7/` → Gitea Web UI
+- `http://taxbaik.com/` 또는 `http://www.taxbaik.com/` → TaxBaik 홈페이지 (내부 proxy: `http://127.0.0.1:5001/taxbaik/`)
-- `http://178.104.200.7/quant/` → QuantEngine Blazor Admin
+- `http://gitea.taxbaik.com/` → Gitea Web UI (내부 proxy: `http://127.0.0.1:3000`)
-- `ssh://178.104.200.7:2222` → Gitea Git SSH
+- `http://quant.taxbaik.com/` → QuantEngine Blazor Admin (내부 proxy: `http://127.0.0.1:5000/`)
+- `ssh://gitea.taxbaik.com:2222` → Gitea Git SSH
 
 ## 5. Gitea
 
@@ -384,7 +422,7 @@ ClientAliveCountMax 2
 | **CI Runner** | Synology Act Runner | 6× `act_runner:latest` (Docker) |
 | **DB** | SQLite (파일 기반) | PostgreSQL 18 + SQLite (하이브리드) |
 | **웹 Admin** | 없음 | QuantEngine Blazor (.NET 10, MudBlazor) |
-| **리버스 프록시** | Synology 내장 | Nginx (`/` → Gitea, `/quant/` → Blazor) |
+| **리버스 프록시** | Synology 내장 | Nginx (도메인 기반 분기 - 홈페이지, Gitea, Quant) |
 | **보안** | DSM 방화벽 | fail2ban + SSH 공개키 + 서비스 로컬바인드 |
 | **시크릿 관리** | `.secrets/kis_real.env` | `/opt/stacks/gitea/.env` |
 | **OS** | Synology DSM 7.x | Ubuntu 26.04 LTS |

DEPLOYMENT_GUIDE.md

@@ -38,13 +38,17 @@ sudo systemctl enable taxbaik
 ### 4. Nginx 설정
 
 ```bash
-# 현재 Nginx 설정 확인
+# Nginx 도메인 기반 가상 호스트 설정 복사
-sudo cat /etc/nginx/sites-available/default | head -30
+sudo cp deploy/nginx-taxbaik-domains.conf /etc/nginx/sites-available/taxbaik-domains.conf
 
-# location 블록 추가 (또는 기존 설정에 병합)
+# 기존 설정(IP 기반 및 default) 활성화 해제
-sudo cp deploy/nginx-taxbaik-locations.conf /etc/nginx/conf.d/taxbaik.conf
+sudo rm -f /etc/nginx/sites-enabled/default
+sudo rm -f /etc/nginx/sites-enabled/gitea-ip.conf
 
-# 테스트 및 재로드
+# 새 설정 활성화 (심링크 생성)
+sudo ln -sfn /etc/nginx/sites-available/taxbaik-domains.conf /etc/nginx/sites-enabled/taxbaik-domains.conf
+
+# 설정 문법 테스트 및 Nginx 서비스 리로드
 sudo nginx -t
 sudo systemctl reload nginx
 ```

deploy/nginx-taxbaik-domains.conf

@@ -0,0 +1,132 @@
+# 1. TaxBaik 홈페이지 (taxbaik.com, www.taxbaik.com)
+server {
+    server_name taxbaik.com www.taxbaik.com;
+    client_max_body_size 512M;
+
+    # 루트 경로 요청을 /taxbaik 으로 프록싱하여 base href /taxbaik/ 에 대응
+    location / {
+        proxy_pass http://127.0.0.1:5001/taxbaik/;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "Upgrade";
+        proxy_set_header Host $host;
+        proxy_cache_bypass $http_upgrade;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    # /taxbaik/ 하위로 들어오는 리소스 및 페이지 요청 처리
+    location /taxbaik {
+        proxy_pass http://127.0.0.1:5001;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "Upgrade";
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 120s;
+    }
+
+    listen 443 ssl; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/taxbaik.com/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/taxbaik.com/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+
+}
+
+# 2. Gitea (gitea.taxbaik.com)
+server {
+    server_name gitea.taxbaik.com;
+    client_max_body_size 512M;
+
+    location / {
+        proxy_pass http://127.0.0.1:3000;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 300;
+        proxy_connect_timeout 300;
+        proxy_send_timeout 300;
+    }
+
+    listen 443 ssl; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/taxbaik.com/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/taxbaik.com/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+}
+
+# 3. QuantEngine (quant.taxbaik.com)
+server {
+    server_name quant.taxbaik.com;
+
+    location / {
+        proxy_pass http://127.0.0.1:5000/;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "Upgrade";
+        proxy_set_header Host $host;
+        proxy_cache_bypass $http_upgrade;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    listen 443 ssl; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/taxbaik.com/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/taxbaik.com/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+}
+
+server {
+    if ($host = www.taxbaik.com) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    if ($host = taxbaik.com) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    listen 80;
+    server_name taxbaik.com www.taxbaik.com;
+    return 404; # managed by Certbot
+
+
+
+
+}
+server {
+    if ($host = gitea.taxbaik.com) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    listen 80;
+    server_name gitea.taxbaik.com;
+    return 404; # managed by Certbot
+
+
+}
+server {
+    if ($host = quant.taxbaik.com) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    listen 80;
+    server_name quant.taxbaik.com;
+    return 404; # managed by Certbot
+
+
+}