feat: add nginx reverse proxy

README.md

@@ -10,16 +10,20 @@ stores content, and Docker Compose supplies a reproducible local environment.
   aggregate read-only API at `GET /api/site/home/`.
 - `frontend/`: Astro components, responsive design system, typed API adapter, and
   Italian fallback content for development when the CMS is unavailable.
+- `nginx/`: reverse-proxy virtual host for `azionelab.org`, routing public requests to
+  Astro or Wagtail.
 - `postgres`: persistent CMS database.
 - Docker volumes: `postgres_data` for the database and `media_data` for uploads.
 
-See [the architecture document](docs/architecture.md) and
-[ADR-0001](docs/adr/0001-headless-wagtail-astro.md) for the rationale.
+See [the architecture document](docs/architecture.md),
+[ADR-0001](docs/adr/0001-headless-wagtail-astro.md), and
+[ADR-0002](docs/adr/0002-nginx-reverse-proxy.md) for the rationale.
 
 ## Prerequisites
 
 - Docker Engine with Docker Compose v2.
-- Ports `4321` and `8000` available on localhost.
+- Ports `8080`, `4321`, and `8000` available on localhost.
+- A local hosts-file entry mapping `azionelab.org` to `127.0.0.1`.
 
 No host Python or Node.js installation is required.
 
@@ -32,15 +36,24 @@ docker compose ps
 docker compose exec backend python manage.py seed_demo
 ```
 
+For local domain resolution, add this line to `/etc/hosts` using your normal system
+administration workflow:
+
+```text
+127.0.0.1 azionelab.org
+```
+
 Open:
 
-- public site: <http://localhost:4321>
-- Wagtail admin: <http://localhost:8000/admin/>
-- aggregate API: <http://localhost:8000/api/site/home/>
+- public site: <http://azionelab.org:8080>
+- Wagtail admin: <http://azionelab.org:8080/admin/>
+- aggregate API: <http://azionelab.org:8080/api/site/home/>
+
+Direct loopback ports `4321` and `8000` remain available for local diagnostics only.
 
 The frontend remains usable with curated fallback content if the API is unavailable.
 On first startup the backend applies migrations and collects static files before
-starting Gunicorn. Wait until `postgres`, `backend`, and `frontend` report healthy.
+starting Gunicorn. Wait until all four services report healthy.
 
 ## Create an editor account
 
@@ -48,7 +61,7 @@ starting Gunicorn. Wait until `postgres`, `backend`, and `frontend` report healt
 docker compose exec backend python manage.py createsuperuser
 ```
 
-Sign in to Wagtail at <http://localhost:8000/admin/>. The public site has no user
+Sign in to Wagtail at <http://azionelab.org:8080/admin/>. The public site has no user
 accounts or authentication.
 
 ## Demo content
@@ -75,14 +88,14 @@ after seeding may be overwritten for records managed by the command.
 
 The frontend reads `PUBLIC_CMS_API_URL`; inside Compose it defaults to
 `http://backend:8000`. Media URLs use `WAGTAILADMIN_BASE_URL` so browsers receive the
-public `http://localhost:8000` address. Change both values for another environment.
+public reverse-proxy address. Change both values for another environment.
 The standard published-page endpoint is also available at `/api/v2/pages/`.
 
 ## Useful commands
 
 ```bash
 # Follow application logs
-docker compose logs -f postgres backend frontend
+docker compose logs -f postgres backend frontend nginx
 
 # Run database migrations
 docker compose exec backend python manage.py migrate
@@ -91,6 +104,7 @@ docker compose exec backend python manage.py migrate
 docker compose run --rm backend python manage.py test
 docker compose run --rm frontend npm run check
 docker compose run --rm frontend npm run build
+docker compose run --rm nginx nginx -t
 docker compose config --quiet
 
 # Stop the stack without deleting content
@@ -109,6 +123,7 @@ local environment; run the seed command again after the next startup.
 .
 ├── backend/                # Wagtail/Django CMS and API
 ├── frontend/               # Astro public website
+├── nginx/                  # Reverse-proxy virtual host
 ├── docs/                   # Architecture, operations, security, and ADRs
 ├── docker-compose.yml
 ├── .env.example
@@ -134,5 +149,5 @@ cautions. Do not commit database dumps, `.env`, or uploaded media.
 ## Production TODOs
 
 This repository deliberately targets a simple, working local deployment. Before a
-public production launch, add a TLS reverse proxy, production-grade static/media
+public production launch, add TLS certificates, production-grade static/media
 serving, off-host backups, monitoring, and a deployment-specific secret manager.