🐳 Docker Infrastructure & Nginx Reverse Proxy

The application stack operates across two isolated Docker network tiers ensuring strict service role separation and security hardening.

---

1. Network Topology & Container Stack

flowchart TD
    subgraph Edge ["Public Edge Proxy"]
        Nginx["Alpine Nginx (Port 80/443)<br/>SSL Termination via Let's Encrypt"]
    end

    subgraph Staging_Network ["staging_net (Host Ports 8070, 8073)"]
        OdooStaging["odoo_staging_web (Odoo 17.0)<br/>workers=0 (Integrated Web/WS)"]
        DBStaging[("odoo_staging_db (PostgreSQL 15)<br/>cpl_real_rewards_staging")]
    end

    subgraph Production_Network ["backend_net / frontend_net"]
        OdooProd["odoo_web (Odoo 17.0)<br/>workers=2 (Gevent on 8072)"]
        DBProd[("odoo_db (PostgreSQL 15)<br/>cpl_real_rewards")]
        Twingate["twingate_connector<br/>Zero-Trust Network Bridge"]
    end

    Nginx -->|"angry-mad-smile.cpl.com.pg"| OdooStaging
    OdooStaging --> DBStaging

    Nginx -->|"rewards.cpl.com.pg"| OdooProd
    OdooProd --> DBProd

---

2. Nginx Security Hardening

The Nginx configuration implements multiple layers of defense:

1. Database Manager Protection (/web/database):
2. Production (rewards.cpl.com.pg): Returns 404 Not Found immediately; list_db = False in odoo.conf.
3. Staging (angry-mad-smile.cpl.com.pg): Proxied to staging backend for test database backup and restoration.
4. Brute Force Rate Limiting:
5. limit_req_zone $binary_remote_addr zone=login_limit:10m rate=30r/m;
6. Protects /web/login from password spray attacks.
7. Security Headers:
8. Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
9. X-Frame-Options "SAMEORIGIN"
10. X-Content-Type-Options "nosniff"
11. Content-Security-Policy

---

3. Operations & Maintenance Runbook

Service Commands:

# Check container logs
docker compose logs -f web

# Check staging container logs
docker compose -f docker-compose.staging.yml logs -f staging_web

# Restart Staging Stack
docker compose -f docker-compose.staging.yml restart staging_web

# Inspect Staging PostgreSQL Database
docker exec -it odoo_staging_db psql -U odoo -d cpl_real_rewards_staging