config: update service urls and nginx upstream configuration

Author: PyDevDeep

backend/config/lexicon.py

@@ -79,4 +79,6 @@
     "schedule_modal_label": "📅 Час публікації (UTC)",
     "schedule_success": "🕒 Пост успішно заплановано на *{scheduled_at}* UTC!\n\n_Ви можете побачити його у вкладці Home._",
     "schedule_no_time_error": "⚠️ Вкажіть час публікації у формі нижче.",
+    # --- Publish Error Notification ---
+    "publish_error_notification": "❌ *Publication error*\n\n*Platform:* {platform}\n*Draft ID:* {post_id}\n*Error:* `{error_message}`",
 }

backend/config/settings.py

@@ -51,8 +51,9 @@ class Settings(BaseSettings):
     # Slack
     SLACK_BOT_TOKEN: SecretStr = Field(default=SecretStr(""))
     SLACK_SIGNING_SECRET: SecretStr = Field(default=SecretStr(""))
+    SLACK_LOG_CHANNEL: str = "C077Z79HB0V"
     # n8n
-    N8N_WEBHOOK_URL: str = "http://127.0.0.1:5678/webhook/publish-post"
+    N8N_WEBHOOK_URL: str = "http://n8n:5678/webhook/publish-post"
     # Pydantic configuration
     model_config = SettingsConfigDict(
         env_file=".env", env_file_encoding="utf-8", extra="ignore"

infra/nginx/nginx.conf

@@ -0,0 +1,78 @@
+upstream optifood_backend {
+    server 127.0.0.1:8000;
+}
+
+upstream seratonin_backend {
+    server 127.0.0.1:8001;
+}
+
+server {
+    server_name optifood-ai.duckdns.org;
+
+    client_max_body_size 20M;
+
+    # Block scanners and hidden files
+    location ~ /\.(?!well-known).* {
+        deny all;
+        access_log off;
+        log_not_found off;
+    }
+
+    location ~* /(vendor|phpunit|laravel|wp-admin|wp-content|backup|myadmin|setup|config) {
+        access_log off;
+        log_not_found off;
+        return 444;
+    }
+
+    location ~* \.php$ {
+        access_log off;
+        log_not_found off;
+        return 444;
+    }
+
+    # Optifood (root)
+    location / {
+        proxy_pass http://optifood_backend;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_connect_timeout 60s;
+        proxy_read_timeout 120s;
+        proxy_send_timeout 120s;
+    }
+
+    # Seratonin — strip /seratonin prefix before passing to FastAPI
+    location /seratonin/ {
+        proxy_pass http://seratonin_backend/;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_connect_timeout 60s;
+        proxy_read_timeout 120s;
+        proxy_send_timeout 120s;
+    }
+
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    add_header X-Frame-Options SAMEORIGIN;
+    add_header X-Content-Type-Options nosniff;
+    add_header X-XSS-Protection "1; mode=block";
+
+    listen 443 ssl;
+    ssl_certificate /etc/letsencrypt/live/optifood-ai.duckdns.org/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/optifood-ai.duckdns.org/privkey.pem;
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+}
+
+server {
+    listen 80;
+    server_name optifood-ai.duckdns.org;
+
+    if ($host = optifood-ai.duckdns.org) {
+        return 301 https://$host$request_uri;
+    }
+
+    return 404;
+}