#nginx

Two commands that keep three environments apart on one machine and one web server: one sets an environment's addresses and aligns every file that stores them, rendering nginx from templates and refusing on clashes; the other points the browser at one environment.

Three commands that build a full copy of production for one release — configuration from the repository, images from the registry, data from the latest backup — restore it in order, run the release's migrations against that data, and remove it without a trace.

Opening a broker to browsers and devices on the internet is less about encryption than identity. Each entrance now accepts one kind of credential, every token is bound to its own name and addressed to this broker, and TLS ends in nginx.

This Laravel app answers HTTP and runs long-lived queue workers, yet a container is meant for one program. A process manager, FrankenPHP worker mode and a cache-ordered build put both in one image, instead of building the same code twice.

Three environments sharing one fixed domain name, separated at the socket rather than by name, with a banner on every environment except production — and live proxy config rendered from a template, never linked into a repository where a branch switch could rewrite it.

Self-signed certificates cost work in every container, and no HTTPS hides bugs in cookies, redirects and OAuth2. I point the real domain at loopback and install the real certificate at the same path, so my laptop runs the same nginx config as production.