replace NPM with vanilla nginx + certbot

- nginx:alpine replaces nginx-proxy-manager
- certbot on host with standalone issuance and auto-renewal
- per-site nginx configs in conf.d/ (HTTP->HTTPS, bare->www)
- container names use underscores (timothykim_net)
- setup.sh: automated cert issuance, dynamic app startup
- deploy.sh: nginx -t guard, graceful image-not-found
- new-app.sh: Gitea API repo creation, nginx conf generation
- add ARCHITECTURE.md, USECASES.md, CLAUDE.md
- remove old NPM data/certs from tracking

docker/nginx/certs/live/npm-1/cert.pem

@@ -1 +0,0 @@
-../../archive/npm-1/cert1.pem

docker/nginx/certs/live/npm-1/chain.pem

@@ -1 +0,0 @@
-../../archive/npm-1/chain1.pem

docker/nginx/certs/live/npm-1/fullchain.pem

@@ -1 +0,0 @@
-../../archive/npm-1/fullchain1.pem

docker/nginx/certs/live/npm-1/privkey.pem

@@ -1 +0,0 @@
-../../archive/npm-1/privkey1.pem

docker/nginx/certs/live/npm-2/cert.pem

@@ -1 +0,0 @@
-../../archive/npm-2/cert1.pem

docker/nginx/certs/live/npm-2/chain.pem

@@ -1 +0,0 @@
-../../archive/npm-2/chain1.pem

docker/nginx/certs/live/npm-2/fullchain.pem

@@ -1 +0,0 @@
-../../archive/npm-2/fullchain1.pem

docker/nginx/certs/live/npm-2/privkey.pem

@@ -1 +0,0 @@
-../../archive/npm-2/privkey1.pem

docker/nginx/certs/live/npm-3/cert.pem

@@ -1 +0,0 @@
-../../archive/npm-3/cert1.pem

docker/nginx/certs/live/npm-3/chain.pem

@@ -1 +0,0 @@
-../../archive/npm-3/chain1.pem

docker/nginx/certs/live/npm-3/fullchain.pem

@@ -1 +0,0 @@
-../../archive/npm-3/fullchain1.pem

docker/nginx/certs/live/npm-3/privkey.pem

@@ -1 +0,0 @@
-../../archive/npm-3/privkey1.pem

docker/nginx/compose.yml

@@ -1,17 +1,18 @@
 services:
-  app:
-    image: 'jc21/nginx-proxy-manager:latest'
+  nginx:
+    image: nginx:alpine
     restart: unless-stopped
-    container_name: npm
+    container_name: nginx
     networks:
       - shared
     ports:
       - '80:80'
       - '443:443'
-      - '81:81'
     volumes:
-      - ./data:/data
-      - ./certs:/etc/letsencrypt
+      - ./nginx.conf:/etc/nginx/nginx.conf:ro
+      - ./conf.d:/etc/nginx/conf.d:ro
+      - /etc/letsencrypt:/etc/letsencrypt:ro
+      - ./certbot/www:/var/www/certbot:ro
 
 networks:
   shared:

docker/nginx/conf.d/timothykim.net.conf

@@ -0,0 +1,48 @@
+# Redirect HTTP to HTTPS, bare domain to www
+server {
+    listen 80;
+    listen [::]:80;
+    server_name timothykim.net www.timothykim.net;
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+
+    location / {
+        return 301 https://www.timothykim.net$request_uri;
+    }
+}
+
+# Redirect bare HTTPS domain to www
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    http2 on;
+    server_name timothykim.net;
+
+    ssl_certificate     /etc/letsencrypt/live/timothykim.net/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/timothykim.net/privkey.pem;
+
+    return 301 https://www.timothykim.net$request_uri;
+}
+
+# Main site
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    http2 on;
+    server_name www.timothykim.net;
+
+    ssl_certificate     /etc/letsencrypt/live/timothykim.net/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/timothykim.net/privkey.pem;
+
+    add_header Strict-Transport-Security "max-age=63072000; preload" always;
+
+    location / {
+        proxy_pass http://timothykim_net:80;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}

docker/nginx/data/nginx/default_host/site.conf

@@ -1,20 +0,0 @@
-# ------------------------------------------------------------
-# Default Site
-# ------------------------------------------------------------
-
-server {
-  listen 80 default;
-listen [::]:80 default;
-
-  server_name default-host.localhost;
-  access_log /data/logs/default-host_access.log combined;
-  error_log /data/logs/default-host_error.log warn;
-
-
-  include conf.d/include/letsencrypt-acme-challenge.conf;
-  location / {
-    return 404;
-  }
-
-}
-

docker/nginx/data/nginx/proxy_host/1.conf

@@ -1,97 +0,0 @@
-# ------------------------------------------------------------
-# www.timothykim.net
-# ------------------------------------------------------------
-
-
-
-map $scheme $hsts_header {
-    https   "max-age=63072000; preload";
-}
-
-server {
-  set $forward_scheme http;
-  set $server         "static";
-  set $port           80;
-
-  listen 80;
-listen [::]:80;
-
-listen 443 ssl;
-listen [::]:443 ssl;
-
-
-  server_name www.timothykim.net;
-http2 off;
-
-
-  # Let's Encrypt SSL
-  include conf.d/include/letsencrypt-acme-challenge.conf;
-  include conf.d/include/ssl-cache.conf;
-  include conf.d/include/ssl-ciphers.conf;
-  ssl_certificate /etc/letsencrypt/live/npm-3/fullchain.pem;
-  ssl_certificate_key /etc/letsencrypt/live/npm-3/privkey.pem;
-
-
-
-
-# Asset Caching
-  include conf.d/include/assets.conf;
-
-
-  # Block Exploits
-  include conf.d/include/block-exploits.conf;
-
-
-
-
-
-
-
-    # Force SSL
-    
-    set $trust_forwarded_proto "F";
-    
-    include conf.d/include/force-ssl.conf;
-
-
-
-
-proxy_set_header Upgrade $http_upgrade;
-proxy_set_header Connection $http_connection;
-proxy_http_version 1.1;
-
-
-  access_log /data/logs/proxy-host-1_access.log proxy;
-  error_log /data/logs/proxy-host-1_error.log warn;
-
-
-
-
-
-
-
-  location / {
-
-
-
-
-
-
-
-
-
-    
-    proxy_set_header Upgrade $http_upgrade;
-    proxy_set_header Connection $http_connection;
-    proxy_http_version 1.1;
-    
-
-    # Proxy!
-    include conf.d/include/proxy.conf;
-  }
-
-
-  # Custom
-  include /data/nginx/custom/server_proxy[.]conf;
-}
-

docker/nginx/data/nginx/proxy_host/2.conf

@@ -1,98 +0,0 @@
-# ------------------------------------------------------------
-# timothykim.net
-# ------------------------------------------------------------
-
-
-
-map $scheme $hsts_header {
-    https   "max-age=63072000; preload";
-}
-
-server {
-  set $forward_scheme http;
-  set $server         "static";
-  set $port           80;
-
-  listen 80;
-listen [::]:80;
-
-listen 443 ssl;
-listen [::]:443 ssl;
-
-
-  server_name timothykim.net;
-
-  http2 on;
-
-
-  # Let's Encrypt SSL
-  include conf.d/include/letsencrypt-acme-challenge.conf;
-  include conf.d/include/ssl-cache.conf;
-  include conf.d/include/ssl-ciphers.conf;
-  ssl_certificate /etc/letsencrypt/live/npm-2/fullchain.pem;
-  ssl_certificate_key /etc/letsencrypt/live/npm-2/privkey.pem;
-
-
-
-
-# Asset Caching
-  include conf.d/include/assets.conf;
-
-
-  # Block Exploits
-  include conf.d/include/block-exploits.conf;
-
-
-
-
-
-
-
-    # Force SSL
-    
-    set $trust_forwarded_proto "F";
-    
-    include conf.d/include/force-ssl.conf;
-
-
-
-
-proxy_set_header Upgrade $http_upgrade;
-proxy_set_header Connection $http_connection;
-proxy_http_version 1.1;
-
-
-  access_log /data/logs/proxy-host-2_access.log proxy;
-  error_log /data/logs/proxy-host-2_error.log warn;
-
-return 301 https://www.timothykim.net$request_uri;
-
-
-
-
-
-  location / {
-
-
-
-
-
-
-
-
-
-    
-    proxy_set_header Upgrade $http_upgrade;
-    proxy_set_header Connection $http_connection;
-    proxy_http_version 1.1;
-    
-
-    # Proxy!
-    include conf.d/include/proxy.conf;
-  }
-
-
-  # Custom
-  include /data/nginx/custom/server_proxy[.]conf;
-}
-

docker/nginx/nginx.conf

@@ -0,0 +1,20 @@
+worker_processes auto;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+    sendfile      on;
+    keepalive_timeout 65;
+
+    access_log /var/log/nginx/access.log;
+    error_log  /var/log/nginx/error.log;
+
+    add_header X-Content-Type-Options nosniff;
+    add_header X-Frame-Options DENY;
+
+    include /etc/nginx/conf.d/*.conf;
+}

docker/timothykim.net/compose.yml

@@ -2,7 +2,7 @@ services:
   static:
     image: git.timothykim.net/hantim/static:latest
     restart: unless-stopped
-    container_name: timothykim-static
+    container_name: timothykim_net
     networks:
       - shared