# Strapi Reverse Proxy

Use this template to expose Strapi admin via nginx with Tailscale-only access.

## Vhost config

Save as `/usr/local/etc/nginx/vhosts/cms.conf`:

```nginx
# Strapi CMS admin — Tailscale-restricted
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name cms.clawdie.si;

    ssl_certificate     /usr/local/etc/nginx/ssl/clawdie/fullchain.cer;
    ssl_certificate_key /usr/local/etc/nginx/ssl/clawdie/clawdie.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    # restrict to Tailscale network only
    allow 100.64.0.0/10;
    deny all;

    location / {
        proxy_pass http://192.168.100.3:1337;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        # Strapi admin uploads can be large
        client_max_body_size 50M;
    }
}
```

## Notes

- Uses the same SSL cert as clawdie.si (wildcard or SAN)
- If no wildcard cert, obtain a separate cert for cms.clawdie.si
- Tailscale IPs are in the 100.64.0.0/10 CGNAT range
- WebSocket headers needed for Strapi admin live reload in dev mode

## DNS

Add a DNS record for `cms.clawdie.si` pointing to the same server IP.
Or use Tailscale MagicDNS if only accessing from the mesh.

## Checklist

1. Create vhost config
2. Add DNS record (or Tailscale entry)
3. `sudo nginx -t`
4. `sudo service nginx reload`
5. Verify: `curl -sI https://cms.clawdie.si` from Tailscale
