Record CLOUD-only LAN public origin configuration

deployment/geranas/README.md

@@ -0,0 +1,11 @@
+FrameBridge public origin on GERANAS
+
+This deployment template extends the existing nginx public origin. Render the two IPv4 placeholders with the selected GERANAS LAN address and CLOUD proxy address, then verify the complete rendered config before applying it. The existing loopback origin and private Tailscale HTTPS route are retained.
+
+The new LAN socket serves the same website, downloads, signed APT indexes and existing Gitea routes. Its access list permits only the CLOUD proxy and loopback requests. The MCP, authentication and broker services are outside this server.
+
+The public client connection terminates HTTPS at CLOUD. CLOUD connects to this origin over the trusted local network using HTTP, matching the existing local reverse proxy architecture. This configuration does not claim end-to-end TLS. Release signatures and pinned package hashes remain independently verifiable.
+
+Deployment: preserve the existing config and a verified public generation, compare the intended four-line diff, run nginx -t against the rendered config, and signal only framebridge-web.service's nginx master with HUP. If validation fails, restore the preserved config and signal HUP again. Check loopback access, CLOUD access and denial from a different LAN client. Do not change firewall rules, Tailscale policy, DNS, certificates or other services as part of this template.
+
+The product release source and signed v0.3.3 tag remain at a52625219e5d7eeadcc0c91d1d0fd92108e6b51a. This operations branch records only the web-origin deployment configuration.

deployment/geranas/nginx.conf.in

@@ -0,0 +1,69 @@
+daemon off;
+worker_processes 1;
+pid /run/framebridge-publisher/nginx.pid;
+error_log stderr warn;
+events { worker_connections 256; }
+http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+    access_log off;
+    server_tokens off;
+    sendfile on;
+    keepalive_timeout 30;
+    client_body_temp_path /run/framebridge-publisher/client-body;
+    proxy_temp_path /run/framebridge-publisher/proxy;
+    fastcgi_temp_path /run/framebridge-publisher/fastcgi;
+    uwsgi_temp_path /run/framebridge-publisher/uwsgi;
+    scgi_temp_path /run/framebridge-publisher/scgi;
+    map $http_upgrade $connection_upgrade { default upgrade; '' close; }
+    server {
+        listen 127.0.0.1:8088;
+        listen @GERANAS_LAN_IP@:8088;
+        allow 127.0.0.1;
+        allow @CLOUD_LAN_IP@;
+        deny all;
+        server_name framebridge.betancourt.one;
+        root /run/framebridge-publisher/site;
+        index index.html;
+        autoindex off;
+        client_max_body_size 64m;
+        add_header X-Content-Type-Options nosniff always;
+        add_header Referrer-Policy strict-origin-when-cross-origin always;
+        add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; media-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'" always;
+        location = /git { return 308 /git/; }
+        location /git/ {
+            rewrite ^ $request_uri;
+            rewrite ^/git/api/v1/repos/framebridge/framebridge(/.*)?$ /api/v1/repos/gerardo/framebridge$1 break;
+            rewrite ^/git/framebridge/framebridge(\.git)?(/.*)?$ /gerardo/framebridge$1$2 break;
+            rewrite ^/(git($|/))?(.*) /$3 break;
+            proxy_pass http://127.0.0.1:3005$uri;
+            proxy_http_version 1.1;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto https;
+            proxy_read_timeout 120s;
+            proxy_request_buffering off;
+            add_header X-Content-Type-Options nosniff always;
+            add_header Referrer-Policy strict-origin-when-cross-origin always;
+        }
+        location = /debian { return 308 /debian/; }
+        location /debian/ {
+            alias /run/framebridge-publisher/debian/;
+            autoindex off;
+            limit_except GET HEAD { deny all; }
+        }
+        location = /downloads { return 308 /downloads/; }
+        location /downloads/ {
+            alias /run/framebridge-publisher/downloads/;
+            autoindex off;
+            limit_except GET HEAD { deny all; }
+        }
+        location / {
+            try_files $uri $uri/ =404;
+            limit_except GET HEAD { deny all; }
+        }
+    }
+}